Privacy compliance and records for Google Cloud

Google Cloud offers Cloud Data Processing Addendum (CDPA) (previously called the Data Processing and Security Terms or DPST), which incorporates Standard Contract Clauses (SCC) as a means of meeting the security, contracting, and data transfer requirements under EU, UK, and Swiss data protection laws. For customers with HIPAA compliance needs, Google offers a Business Associate Addendum.

How to opt in to the Cloud Data Processing Addendum

You need to opt into the CDPA only if your Google Cloud agreement does not already incorporate the CDPA (or the DPST) by reference. If you’d like to opt in, complete the following steps:

1. Go to the Google Cloud IAM & Admin page.

2. If a project isn't already selected, select a project to use to opt in.

   Note: If you have multiple Google Cloud projects, you only need to opt in to the CDPA within one Google Cloud project in your account.

3. Below Cloud Data Processing Addendum, click Review and Accept.

4. Read the agreement and then click I Accept.

Read more about Google’s approach to the General Data Protection Regulation and Google Cloud Trust & Security.

How to indicate if European Data Protection Law applies to you and provide related information

If your use of Google Cloud is subject to the EU GDPR, UK GDPR, or the Swiss FDPA (each as defined in the Cloud Data Processing Addendum (CDPA), previously called the Data Processing and Security Terms or DPST), and your billing address is outside Europe, the Middle East, and Africa, then you need to certify as such, and identify your competent Supervisory Authority by following the steps below.

Certify if European Data Protection Law applies

1. Go to the Google Cloud IAM & Admin page.

2. If a project isn't already selected, select a project to use to opt in.

   Note: If you have multiple Google Cloud projects, you only need to certify within one Google Cloud project in your account.

3. Go to Privacy & Security, and click Legal & Compliance.

4. Under Indicate that European Data Protection Law applies to you, click Certify if applicable.

Provide details of your European supervisory authority, DPO, and representative

You must be signed in to the Google Workspace Admin console as a super administrator for this task.

1. To proceed, switch to a super administrator account. This opens the Workspace Admin console.
2. From the Admin console, go to Account settings > Legal & Compliance.
3. Under Your Supervisory Authorities, identify the applicable authority or authorities.
4. Also, if applicable for your organization, enter Your data protection officer details and/or Your European representative details.
5. Click Save.

How to accept the HIPAA Business Associate Addendum

For customers with HIPAA compliance needs, Google offers a Business Associate Addendum (BAA).

You can opt into the BAA only if your Google Cloud agreement does not already incorporate the HIPAA BAA by reference. If you’d like to opt in, complete the following steps:

1. Go to the Google Cloud IAM & Admin page.

2. If a project isn't already selected, select a project to use to opt in.

   Note: If you have multiple Google Cloud projects, you only need to opt in to the HIPAA BAA within one Google Cloud project in your account.

3. Below Google Cloud Platform HIPAA Business Associate Addendum, click Review and Accept.

4. Read the agreement and then click I Accept.