Snowflake Affiliate Processing Network

What it is

The document lists thirty-one Snowflake-affiliated legal entities across twenty-nine countries authorized to process Customer Data for purposes of technical services, support services, and the provision, management, and maintenance of the Snowflake service, all operating under SCCs.

Why it matters (compliance & governance perspective)

This provision establishes that Customer Data processing is distributed across a global network of Snowflake-owned entities in jurisdictions including India, UAE, Saudi Arabia, Turkey, Israel, South Korea, Brazil, Colombia, and Costa Rica, each requiring individual assessment under applicable data transfer frameworks.

Consumer impact (what this means for users)

This provision establishes that Customer Data may be processed by Snowflake-affiliated entities in up to twenty-nine countries as part of service delivery, with Standard Contractual Clauses as the stated transfer mechanism for all non-adequate-jurisdiction flows.

Institutional analysis (regulatory & governance intelligence)

(1) REGULATORY LANDSCAPE: Affiliate processing by entities in third countries engages GDPR Chapter V and UK GDPR transfer requirements. Countries represented in the affiliate list that lack EU adequacy decisions include India, UAE, Saudi Arabia, Turkey, Israel, South Korea, Brazil, Colombia, and Costa Rica, each requiring reliance on SCCs or other transfer mechanisms. Relevant enforcement authorities include EU national data protection authorities and the UK ICO. (2) GOVERNANCE EXPOSURE: Medium. The scope of the affiliate network (thirty-one entities across twenty-nine countries) creates a broad surface area for transfer impact assessment obligations. Customers in regulated industries with heightened cross-border transfer scrutiny (financial services, healthcare) face the greatest compliance overhead. (3) JURISDICTION FLAGS: EU and UK customers must assess whether SCCs provide adequate protection for transfers to each affiliate country individually. Israel holds EU adequacy status, and South Korea has received a partial adequacy assessment under GDPR. Other jurisdictions in the list (Saudi Arabia, UAE, Turkey, Colombia, Costa Rica) do not hold EU adequacy decisions and require Clause 14(c) assessments. (4) CONTRACT AND VENDOR IMPLICATIONS: DPAs with Snowflake should confirm that affiliate processing is covered by the same data protection obligations as direct processing by Snowflake Inc., including sub-processor flow-down requirements under GDPR Article 28(4). Legal teams should request LEI numbers and updated Clause 14(c) information for affiliate entities operating in non-adequate jurisdictions. (5) COMPLIANCE CONSIDERATIONS: Records of Processing Activities and internal data flow maps should reflect the full affiliate list including recently added entities in Malaysia, Turkey (added March 2026), Saudi Arabia (added January 2025), and two Saudi Arabia entities for regional headquarters functions. Compliance teams should confirm that their GDPR Article 30 records are updated to reflect the most recent affiliate additions documented in the Updates Summary.

Applicable agencies

Provision details

Other risks in this policy

• AWS authorized for Cortex cross-region inference GCP and Azure medium
• AWS authorized for Data Clean Rooms Web App medium
• AWS authorized for GCP native app security scanning medium
• Azure authorized for Cortex cross-region inference GCP and AWS medium
• Clause 14(c) information available on request medium
• Clause 14(c) updates disclosed by email on request medium