Box describes how it handles personal data in a separate Privacy Policy, and if you are subject to data protection laws like GDPR, a separate Data Processing Agreement governs how Box handles your data.
This analysis describes what Box's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Organizations subject to GDPR, CCPA, or other data protection laws need to ensure they have executed a Data Processing Agreement with Box, as the standard terms alone may not satisfy regulatory requirements for data processor relationships.
Interpretive note: The adequacy of Box's data transfer mechanisms for EU personal data and the specific terms of Box's Data Processing Agreement require separate review and are not fully addressed in the standard terms of service.
The updated terms establish that Box may bill customers automatically for consumption of enterprise-wide service resources (API Calls, AI Units) that exceed entitlements associated with the customer's service level. Previously, the terms only mentioned that 'additional fees will be due' if Platform Use Limits were exceeded, but the new language creates explicit billing procedures, pricing references, and usage control mechanisms. The agreement now authorizes Box to provide usage reports identifying overage, charge customers for excess resource consumption, and implement technical controls including throttling, rate limiting, or temporary service suspension until overage charges are paid. Users can contact Box through its web form or email to dispute usage reports, but the terms reserve all other contractual and statutory remedies to Box.
View change record →Personal data stored on Box is governed by Box's Privacy Policy and, for regulated users, a separate Data Processing Agreement that must be actively executed and reviewed to ensure compliance with applicable privacy laws.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
"Box's collection and use of personal information in connection with the services is described in Box's Privacy Policy. To the extent that Box processes any personal data on your behalf that is subject to applicable data protection laws, such processing is governed by the Box Data Processing Agreement.Excerpt from Box's Terms of Service
REGULATORY LANDSCAPE: This provision directly engages GDPR (Articles 28 and 29 on processor obligations), CCPA (service provider agreement requirements), and potentially HIPAA (Business Associate Agreement requirements for healthcare-sector customers).
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Organizations subject to GDPR, CCPA, or other data protection laws need to ensure they have executed a Data Processing Agreement with Box, as the standard terms alone may not satisfy regulatory requirements for data processor relationships.
Personal data stored on Box is governed by Box's Privacy Policy and, for regulated users, a separate Data Processing Agreement that must be actively executed and reviewed to ensure compliance with applicable privacy laws.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Box.