Thomson Reuters Privacy

This document is Thomson Reuters' global Privacy Statement, governing how Thomson Reuters and its worldwide affiliated companies and subsidiaries collect, use, disclose, and retain personal information across their products, services, and websites, with stated legal bases including consent, legitimate interests, contract performance, and legal obligation. The statement asserts that Thomson Reuters collects a broad range of personal data including contact details, financial information, government-issued identifiers, professional and employment data, location data, device and usage data, and sensitive categories such as health, biometric, and political information, and states that this data may be shared with affiliated entities, business partners, third-party service providers, government authorities, and purchasers in corporate transactions. Notably, the statement covers Thomson Reuters' role both as a data controller and as a data processor on behalf of business customers, and explicitly addresses the use of personal data in AI and machine learning model training, which creates distinct exposure in jurisdictions with emerging AI-specific regulation; the statement also discloses that Thomson Reuters operates as a data broker in certain contexts, compiling and selling information products derived from publicly available and licensed data sources. The statement engages GDPR and UK GDPR for EU and UK residents, CCPA and CPRA for California residents, PIPEDA and provincial equivalents for Canadian users, and a range of additional national frameworks; the document includes region-specific supplemental notices and describes cross-border data transfer mechanisms including Standard Contractual Clauses and adequacy decisions. Material compliance considerations include the adequacy of consent mechanisms for sensitive data processing, the lawfulness of AI training data use under GDPR, and the sufficiency of Thomson Reuters' data broker disclosures under state-level U.S. law.