Track 1 platform and get the weekly governance digest. No credit card required.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
DocuSign's Privacy Statement establishes the company's data collection, processing, and sharing practices for personal information generated through its document signing and management platform. The statement authorizes DocuSign to process document content and metadata, and permits sharing of personal data with third-party service providers and business partners for service delivery, analytics, and marketing purposes. The statement defines data subject rights available to California residents and EU users, including access, deletion, and opt-out mechanisms available through DocuSign's privacy portal.
This document is DocuSign's global Privacy Notice, governing the collection, use, storage, and disclosure of personal data across DocuSign's products and services, with legal bases including consent, contractual necessity, and legitimate interests depending on jurisdiction. The notice states that DocuSign collects identifiers, contact data, device and usage data, geolocation, payment information, and the contents of documents processed through its platform, and the terms authorize sharing this data with service providers, business partners, and in connection with corporate transactions such as mergers or acquisitions. A notable operational distinction is DocuSign's role as both a data controller (for account and marketing data) and a data processor (for customer-submitted document content), meaning the privacy protections applicable to document content depend substantially on the enterprise customer's own data agreements rather than this notice alone. The notice engages GDPR and UK GDPR for EEA and UK users, CCPA and CPRA for California residents, and references additional regional frameworks including Brazil's LGPD, Australia's Privacy Act, and Canadian PIPEDA; cross-border data transfer mechanisms including Standard Contractual Clauses are referenced for EU data flows. Material compliance considerations include the adequacy of consent mechanisms for marketing communications, the scoping of processor versus controller obligations for enterprise customers, and the exercise of data subject rights across multiple applicable regimes.
Institutional analysis available with Compliance
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.
Start Compliance free trial3 important changes detected
5 versions captured · Last updated: May 2026
DocuSign's privacy policy now displays language indicating available translations (French, German, Japanese, Portuguese, Spanish, Dutch, Italian, and English) at the beginning of the document. This is a formatting and accessibility …
View change record →This new provision explicitly discloses that DocuSign collects and processes the actual content of documents, which is material for users to understand what data is collected beyond metadata.
This provision consolidates EU/UK data subject rights and cross-border transfer mechanisms in one location with explicit reference to Standard Contractual Clauses, providing critical GDPR/UK GDPR compliance information.
This standalone provision was removed, though its content appears to be partially absorbed into the new EU/UK-specific provision and California-specific provision, potentially fragmenting global user rights information.
Removal of this provision eliminates explicit disclosure about age restrictions and children's data handling, which is typically required by privacy regulations like COPPA and GDPR.
Removal of this standalone provision means law enforcement disclosure practices are no longer explicitly highlighted, though may be covered in the combined third-party sharing provision.
Previous version had no excerpt; current version adds detailed explanation of the distinction between controller and processor roles with specific examples.
Previous version title focused on 'advertising' whereas current version provides comprehensive enumeration of all third-party sharing scenarios, removing the specific advertising emphasis.
Previous version had no excerpt; current version adds specific detail about types of tracking technologies (web beacons, pixel tags) and scope of tracking.
Previous version had no excerpt; current version adds explicit enumeration of CCPA/CPRA rights including opt-out of sale/sharing and limitation of sensitive data use.
Previous version had no excerpt; current version adds specific purposes for retention including legal, accounting, and reporting requirements.
1 provision unchanged.
View full change record →Monitoring
DocuSign has updated this document before.
Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
Compliance Governance Intelligence
Need provision-level monitoring and regulatory mapping?
Compliance includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.
Start Compliance free trialCross-platform context
See how other platforms handle Identity Verification and Biometric-Adjacent Data Collection and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.