Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document lists thirty-one Snowflake-affiliated legal entities across twenty-nine countries authorized to process Customer Data for purposes of technical services, support services, and the provision, management, and maintenance of the Snowflake service, all operating under SCCs.
This analysis describes what Snowflake's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Customer Data processing is distributed across a global network of Snowflake-owned entities in jurisdictions including India, UAE, Saudi Arabia, Turkey, Israel, South Korea, Brazil, Colombia, and Costa Rica, each requiring individual assessment under applicable data transfer frameworks.
This provision establishes that Customer Data may be processed by Snowflake-affiliated entities in up to twenty-nine countries as part of service delivery, with Standard Contractual Clauses as the stated transfer mechanism for all non-adequate-jurisdiction flows.
Cross-platform context
See how other platforms handle Snowflake Affiliate Processing Network and similar clauses.
Compare across platforms →Monitoring
Snowflake has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"To deliver services, Snowflake Inc. ("Snowflake") and its Affiliates may use third-party data processors ("Third-Party Sub-processors") and Snowflake Affiliates to process Customer Data.Excerpt from Snowflake's Sub-Processors
(1) REGULATORY LANDSCAPE: Affiliate processing by entities in third countries engages GDPR Chapter V and UK GDPR transfer requirements. Countries represented in the affiliate list that lack EU adequacy decisions include India, UAE, Saudi Arabia, Turkey, Israel, South Korea, Brazil, Colombia, and Costa Rica, each requiring reliance on SCCs or other transfer mechanisms. Relevant enforcement authorities include EU national data protection authorities and the UK ICO. (2) GOVERNANCE EXPOSURE: Medium. The scope of the affiliate network (thirty-one entities across twenty-nine countries) creates a broad surface area for transfer impact assessment obligations. Customers in regulated industries with heightened cross-border transfer scrutiny (financial services, healthcare) face the greatest compliance overhead. (3) JURISDICTION FLAGS: EU and UK customers must assess whether SCCs provide adequate protection for transfers to each affiliate country individually. Israel holds EU adequacy status, and South Korea has received a partial adequacy assessment under GDPR. Other jurisdictions in the list (Saudi Arabia, UAE, Turkey, Colombia, Costa Rica) do not hold EU adequacy decisions and require Clause 14(c) assessments. (4) CONTRACT AND VENDOR IMPLICATIONS: DPAs with Snowflake should confirm that affiliate processing is covered by the same data protection obligations as direct processing by Snowflake Inc., including sub-processor flow-down requirements under GDPR Article 28(4). Legal teams should request LEI numbers and updated Clause 14(c) information for affiliate entities operating in non-adequate jurisdictions. (5) COMPLIANCE CONSIDERATIONS: Records of Processing Activities and internal data flow maps should reflect the full affiliate list including recently added entities in Malaysia, Turkey (added March 2026), Saudi Arabia (added January 2025), and two Saudi Arabia entities for regional headquarters functions. Compliance teams should confirm that their GDPR Article 30 records are updated to reflect the most recent affiliate additions documented in the Updates Summary.
This provision establishes that Customer Data processing is distributed across a global network of Snowflake-owned entities in jurisdictions including India, UAE, Saudi Arabia, Turkey, Israel, South Korea, Brazil, Colombia, and Costa Rica, each requiring individual assessment under applicable data transfer frameworks.
This provision establishes that Customer Data may be processed by Snowflake-affiliated entities in up to twenty-nine countries as part of service delivery, with Standard Contractual Clauses as the stated transfer mechanism for all non-adequate-jurisdiction flows.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Snowflake.