Data processing agreement (dpa) — Cloudflare Zero Trust

Cited by

Facts read from this source

• DPA version Report an error

  “Cloudflare Data Processing Addendum Version 6.4, effective April 3, 2026”

• DPA party Report an error

  “Cloudflare, Inc. (“Cloudflare ”) and the counterparty agreeing to these terms (“Customer ”) have entered into an Enterprise Subscription Agreement, Self-Serve Subscription Agreement or other written or electronic agreement for the Services provided by Cloudflare (the “Main Agreement ”).”

• Data importer address Report an error

  “Name: Cloudflare, Inc. Address: 101 Townsend Street San Francisco, CA 94107 USA”

• Dpf certification Report an error

  “Customer acknowledges that Cloudflare complies with the Data Privacy Framework and that transfers of Customer Data to Cloudflare made under the Data Privacy Framework shall not be a Restricted Transfer.”

• Global cbpr certified Report an error

  “Cloudflare has certified to the Global CBPR System and the Global PRP System.”

• List URL Report an error

  “Cloudflare will maintain a list of sub-Processors at https://www.cloudflare.com/gdpr/subprocessors/ and will add the names of new and replacement sub-Processors to the list at least thirty (30) days prior to the date on which those sub-Processors commence processing of Personal Data.”

• Breach notification Report an error

  “without undue delay notify the Customer upon becoming aware of any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed for the purpose of providing the Services to Customer”

• Audit report Report an error

  “an audit report not older than thirteen (13) months, prepared by an independent external auditor demonstrating that Cloudflare’s technical and organizational measures are sufficient and in accordance with an accepted industry audit standard”

• CCPA commitments Report an error

  “Cloudflare will not “sell” or “share” such Personal Data, as those terms are defined in the CCPA.”

• No marketing use Report an error

  “not use the Personal Data for the purposes of marketing or advertising”

• Data deletion or return Report an error

  “following termination or expiry of the Main Agreement or completion of the Service, at the choice of Customer, delete or return all Personal Data (including copies thereof) processed pursuant to this DPA”

• Government request commitments Report an error

  “Cloudflare has never turned over our encryption or authentication keys or our customers' encryption or authentication keys to anyone.”

• DPA conflict precedence Report an error

  “In the event of any conflict between the terms of this DPA and the terms of the Main Agreement, the terms of this DPA shall prevail so far as the subject matter concerns the processing of Personal Data.”

• Subprocessor objection termination Report an error

  “If Cloudflare, in its discretion, requires use of the sub-Processor and is unable to satisfy Customer’s objection regarding the proposed use of the new or replacement sub-Processor, then Customer may terminate the applicable Order Form effective upon the date Cloudflare begins use of such new or replacement sub-Processor”

• Assistance dpia Report an error

  “data protection impact assessments and prior consultations (as such terms are defined in Applicable Data Protection Laws)”

• Subject request handling Report an error

  “promptly notify the Customer if it receives a request from a data subject to exercise any data protection rights (including rights of access, rectification or erasure) in respect of that data subject’s Personal Data (a “Data Subject Request ”). Cloudflare shall not respond to a Data Subject Request without the Customer’s prior written consent”

• Roles Report an error

  “the parties acknowledge and agree that the Customer is the Controller (or a Processor processing Personal Data on behalf of a third-party Controller), and Cloudflare is a Processor (or sub-Processor, as applicable).”

• Data categories Report an error

  “Any Personal Data processed in Customer Logs, such as IP addresses, and in the case of Cloudflare Zero Trust, Cloudflare Zero Trust end user names and email addresses.”

6 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The DevOps Engineer Architecture, reliability & security assurance
• The DevOps Engineer European sovereignty
• The IT Lead Architecture, reliability & security assurance
• The IT Lead European sovereignty
• The MSP Technician Logs, audit trail & incident response
• The MSP Technician Architecture, reliability & security assurance
• The MSP Technician European sovereignty
• The Operations Manager Logs, audit trail & incident response
• The Operations Manager Architecture, reliability & security assurance
• The Operations Manager European sovereignty
• The Information Security Officer Architecture, reliability & security assurance
• The Information Security Officer European sovereignty
• The Skeptic European sovereignty