Fastly Inc. holds DPF certification for EU-U.S., UK Extension, and Swiss-U.S. frameworks, but the policy explicitly states that no Fastly subsidiaries or affiliates are covered by or adhere to DPF principles.
This analysis describes what Fastly's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a certification boundary that limits DPF protections to the Fastly Inc. legal entity, requiring organizations that process personal data through Fastly subsidiaries to identify and rely on alternative lawful transfer mechanisms for cross-border data flows.
Under this clause, individuals whose personal data is processed by Fastly subsidiaries or affiliates rather than Fastly Inc. directly do not benefit from DPF protections, and any applicable cross-border transfer mechanism would depend on separate contractual or regulatory arrangements between those entities.
Cross-platform context
See how other platforms handle DPF Certification Scope Limitation and similar clauses.
Compare across platforms →"No Fastly Inc. entities, subsidiaries, or affiliates are covered under the DPF Program or adhere to its Principles. Fastly, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.Excerpt from Fastly's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes a certification boundary that limits DPF protections to the Fastly Inc. legal entity, requiring organizations that process personal data through Fastly subsidiaries to identify and rely on alternative lawful transfer mechanisms for cross-border data flows.
Under this clause, individuals whose personal data is processed by Fastly subsidiaries or affiliates rather than Fastly Inc. directly do not benefit from DPF protections, and any applicable cross-border transfer mechanism would depend on separate contractual or regulatory arrangements between those entities.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Fastly.