The policy states that user data may be transferred to another entity as part of a corporate reorganization, merger, acquisition, or asset sale, and that Dropbox will notify users via the account email address and describe available choices at the time of such an event.
This analysis describes what Dropbox's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision reserves the right to transfer user personal data and file content to a successor entity without requiring advance consent, with notification and choice disclosure committed at the time of the transaction. Compliance teams should assess whether this notification and choice mechanism satisfies applicable data protection requirements for data transfers to new controllers.
Interpretive note: The specific choices available to users at the time of a corporate transaction are not defined in the policy, creating ambiguity about the practical scope of user control in that scenario.
Under this clause, personal data stored in Dropbox accounts may be transferred to a new entity in connection with a corporate transaction, with the agreement committing to email notification and disclosure of available choices at the time of the event. The specific choices available to users are not defined in advance in the policy text.
Cross-platform context
See how other platforms handle Data Transfer on Corporate Reorganization or Sale and similar clauses.
Compare across platforms →"If we're involved in a reorganization, merger, acquisition, or sale of our assets, your data may be transferred as part of that deal. We'll notify you (for example, via a message to the email address associated with your account) of any such deal and outline your choices in that event.Excerpt from Dropbox's Privacy Policy
1) REGULATORY LANDSCAPE: This provision engages GDPR requirements regarding transfers to new data controllers, including potential requirements for updated privacy notices, new lawful bases for processing, and data subject notification.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision reserves the right to transfer user personal data and file content to a successor entity without requiring advance consent, with notification and choice disclosure committed at the time of the transaction. Compliance teams should assess whether this notification and choice mechanism satisfies applicable data protection requirements for data transfers to new controllers.
Under this clause, personal data stored in Dropbox accounts may be transferred to a new entity in connection with a corporate transaction, with the agreement committing to email notification and disclosure of available choices at the time of the event. The specific choices available to users are not defined in advance in the policy text.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Dropbox.