Government Transparency Reporting

What it is

Salesforce publishes annual transparency reports disclosing how many government requests for customer data it received and how it responded.

Why it matters (compliance & governance perspective)

The provision establishes transparency regarding the institutional processes and frequency of government data access, enabling stakeholders to assess the scope and patterns of regulatory and law enforcement data demands against the company's stated data protection framework.

Consumer impact (what this means for users)

Salesforce discloses government data request figures annually through publicly available Transparency Reports. Reviewing these reports can help enterprise customers and individuals assess the frequency and nature of government access to data on Salesforce platforms.

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Government data requests implicate law enforcement disclosure frameworks including the US Electronic Communications Privacy Act, FISA Section 702 for intelligence-related requests, and equivalent national security and law enforcement access regimes in other jurisdictions. Transparency reporting is a voluntary practice not mandated by US law, though it aligns with principles supported by the Electronic Frontier Foundation and other advocacy bodies. For EU data transfers, government access by third-country authorities is a key factor in adequacy determinations under GDPR. GOVERNANCE EXPOSURE: Low in terms of direct compliance risk from the transparency reporting itself, but Medium in terms of the underlying government access risk it discloses. Enterprise customers in regulated industries (financial services, healthcare) should review Transparency Report figures to assess whether government access to Salesforce-stored data creates risks under sector-specific confidentiality obligations. JURISDICTION FLAGS: EU and UK data controllers transferring personal data to Salesforce infrastructure in the US should be aware that FISA Section 702 access by US intelligence agencies is a factor relevant to transfer mechanism adequacy assessments post-Schrems II. The DPF adequacy decision addressed this through the US Executive Order on Enhancing Safeguards for US Signals Intelligence Activities, but legal challenges remain. CONTRACT AND VENDOR IMPLICATIONS: Enterprise procurement and legal teams should review Salesforce's published Transparency Reports as part of vendor due diligence. The availability of published figures and stated principles for challenging overbroad requests is relevant to risk assessments for sensitive data stored on Salesforce platforms. COMPLIANCE CONSIDERATIONS: Organizations in regulated industries should assess whether Salesforce's government disclosure practices are consistent with their own regulatory obligations, including notification requirements to affected data subjects or regulators following government access. Data classification policies should identify which data stored in Salesforce would be most sensitive in the event of a government request.

Applicable agencies

Provision details

Other risks in this policy

• Processor Carve-Out from Privacy Statement Scope medium
• Advertising Data Sharing and Opt-Out Right medium
• Minor Data Opt-In Requirement medium
• International Data Transfers and Data Privacy Framework medium
• Data Subject Rights Framework medium
• Third-Party Dispute Resolution and Supervisory Authority Complaint Rights low