Zoom Sub-Processors

This document is Zoom's Third-Party Subprocessor and Affiliate disclosure list, effective 29 April 2026, published under obligations arising from Zoom's Data Processing Agreement (DPA) and applicable data protection frameworks including the EU General Data Protection Regulation. The document states that Zoom requires all subprocessors to satisfy equivalent obligations as those imposed on Zoom as a Data Processor under its DPA, including processing personal data per controller instructions, maintaining personnel confidentiality obligations, reporting security breaches promptly, and cooperating with data subject and regulatory requests. The document identifies 25 third-party subprocessors, several of which are AI-focused vendors including Anthropic, OpenAI, Perplexity, ElevenLabs, Suki AI, and Sumit-AI, each authorized to process Customer Content and context when AI features are enabled, with transfers to the United States as the primary processing location and Standard Contractual Clauses (SCCs) as the stated transfer mechanism for most entries; Oracle relies on Binding Corporate Rules and includes Saudi Arabia as a processing location. The document engages GDPR and its Chapter V international transfer requirements, as well as jurisdiction-specific data protection regimes applicable to Zoom's affiliates in China, India, South Korea, Saudi Arabia, and other locations; the adequacy of SCCs as a transfer mechanism in these contexts may require evaluation under current regulatory guidance, particularly following Schrems II and evolving enforcement posture in the EU. Compliance teams reviewing vendor and affiliate exposure should note that Zoom's Chinese affiliates, including entities in Shanghai, Hangzhou, Wuhan, and Suzhou, are listed without an explicit international transfer mechanism, and that the affiliate-level data transfer agreement incorporating SCCs is referenced but not separately published in this document.