Data Processing Addendum and GDPR Transfer Mechanism

What it is

Snowflake publishes a Data Processing Addendum, a Transfer Mechanism document, and a DPIA Fact Sheet as part of its legal framework, indicating that cross-border personal data transfers and GDPR-compliant processing obligations are addressed through separate operative documents.

Why it matters (compliance & governance perspective)

This provision establishes that Snowflake's GDPR-related data processing obligations, including the legal basis for cross-border data transfers, are governed by a separate Data Processing Addendum and Transfer Mechanism document. EU and UK customers must obtain and review these documents to confirm that their use of Snowflake satisfies GDPR Chapter V transfer requirements.

This document changed recently

Consumer impact (what this means for users)

EU and UK customers processing personal data through Snowflake are subject to the terms of the Data Processing Addendum and Transfer Mechanism in addition to the base Terms of Service. The DPIA Fact Sheet is available to assist customers in conducting their own data protection impact assessments as required under GDPR Article 35.

Institutional analysis (regulatory & governance intelligence)

1. REGULATORY LANDSCAPE: The Data Processing Addendum and Transfer Mechanism directly engage GDPR, including Articles 28 (processor obligations), 32 (security of processing), and Chapter V (cross-border transfer restrictions). The DPIA Fact Sheet engages GDPR Article 35. Enforcement authorities include EU member state data protection authorities and the UK Information Commissioner's Office. The existence of a Snowflake Data Privacy Framework Notice also indicates engagement with the EU-U.S. Data Privacy Framework as a transfer mechanism. 2. GOVERNANCE EXPOSURE: High for EU and UK customers. The operative content of the DPA and Transfer Mechanism is not disclosed on this index page, requiring customers to obtain and review the full documents. The DPA must satisfy GDPR Article 28 requirements to constitute a valid processor agreement. If the DPA or Transfer Mechanism is deficient, EU and UK customers may face regulatory exposure for unlawful data transfers or inadequate processor agreements. 3. JURISDICTION FLAGS: EU member states and the UK create the highest exposure under this provision. Organizations subject to Swiss data protection law should also confirm the applicability of the Transfer Mechanism to Swiss-origin data. The Data Privacy Framework Notice indicates that Snowflake may rely on the EU-U.S. Data Privacy Framework for some transfers, which has a distinct legal basis from Standard Contractual Clauses. 4. CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should obtain the full DPA and Transfer Mechanism documents and confirm they satisfy the requirements of applicable data protection law. The DPA should specify the subject matter, duration, nature, and purpose of processing; the type of personal data; and the categories of data subjects, as required under GDPR Article 28(3). Organizations should also review the Sub-Processors list in conjunction with the DPA to assess sub-processor management obligations. 5. COMPLIANCE CONSIDERATIONS: EU and UK organizations should confirm that a fully executed DPA is in place with Snowflake covering all applicable processing activities. The DPIA Fact Sheet should be obtained and reviewed as part of any internal DPIA process for high-risk processing activities. Organizations using the EU-U.S. Data Privacy Framework as a transfer mechanism should monitor any changes to that framework's adequacy status.

Applicable agencies

Provision details

Other risks in this policy

• CCPA Do Not Share My Personal Information Opt-Out medium
• Layered Contractual Structure with Product-Specific Addenda medium
• U.S. Government Entity Terms medium
• AI Features Governed by Separate Snowflake AI Terms medium
• Law Enforcement Requests Policy and Transparency Reports medium
• Sub-Processors and Affiliates Disclosure medium