What are the institutional and regulatory implications of this document?

1. REGULATORY LANDSCAPE: This document directly engages GDPR Article 28, which requires data processors to obtain controller authorization before engaging subprocessors and to impose equivalent data protection obligations on those subprocessors by contract. Analogous obligations arise under UK GDPR, the Swiss Federal Act on Data Protection, and state privacy laws including CCPA and its regulations, which impose vendor management and contractual requirements on businesses using service providers…

How does Zoom's Zoom Sub-Processors affect users?

The document establishes that customer data processed through Zoom's services may be handled by a range of third-party subprocessors and Zoom-affiliated entities, with processing occurring in multiple countries including the United States and countries within the European Union. The agreement states that each subprocessor is subject to data protection obligations no less protective than those in Zoom's customer Data Processing Agreement. Customers operating under a signed Data Processing Agreem…

How often is Zoom's Zoom Sub-Processors updated?

ConductAtlas monitors this document daily and captures every version with cryptographic hashing and timestamp verification. Update frequency varies — see the change timeline on this page for complete version history.

Can I get alerted when Zoom updates this document?

Yes. Monitor subscribers ($19/month) can add Zoom to their watchlist and receive same-day email alerts whenever this document or any other Zoom document changes.

CA-D-000930

Zoom Sub-Processors

Zoom

Last change detected July 6, 2026 Sub processor list

SHA-256: 144798ca3a98501441f… 1 version captured 0 changes documented

Create free account

Track 3 platforms and get the weekly governance digest. No credit card required.

View original document at Zoom ↗

This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology

5 Total

0 High severity

5 Medium severity

0 Low severity

Summary

This is Zoom's public disclosure of the third-party companies and Zoom-affiliated entities that process customer data in connection with Zoom's services. The document identifies each subprocessor by name, the processing purpose, and the country or region where data processing occurs, covering infrastructure, support, analytics, security, and AI functions. Zoom states that customers who have signed a Data Processing Agreement with Zoom may be entitled to object to new subprocessors through a notification and objection process described in that agreement.

Technical / Legal Breakdown

This document is Zoom's Third-Party Subprocessors and Zoom Affiliates list, published on Zoom's trust portal, which discloses the vendors and Zoom-affiliated entities that process personal data on behalf of Zoom's customers, operating under Zoom's customer data processing agreements and applicable data protection law including GDPR. The document states that Zoom engages subprocessors to assist in delivering its services and that each subprocessor is bound by obligations no less protective than those Zoom commits to customers under its Data Processing Agreement. The list identifies subprocessors by name, purpose, and data processing location, covering categories including cloud infrastructure, customer support tooling, analytics, security operations, and AI-related processing, with processing locations spanning the United States, European Union, and other regions. This disclosure structure engages GDPR Article 28 requirements governing controller-to-processor and processor-to-subprocessor relationships, as well as analogous obligations under the UK GDPR, the Swiss Federal Act on Data Protection, and various state-level privacy frameworks including the California Consumer Privacy Act. Organizations subject to GDPR or UK GDPR that rely on Zoom as a processor should evaluate whether this list and its update notification mechanism satisfy their own downstream subprocessor management obligations, including whether contractual objection rights are operationally preserved.

Institutional Analysis

Institutional analysis available with Compliance

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.

Get Compliance

Medium — 5 provisions

Subprocessor Obligation Equivalence Commitment

Zoom states that each subprocessor it engages is subject to data protection obligations equivalent to those Zoom undertakes toward its customers under its Data Processing Agreement, establishing a chain of contractual data protection requirements through the subprocessor relationship.

Added July 6, 2026 Rare
Customer Objection Rights via Data Processing Agreement

The document indicates that customers who have executed a Data Processing Agreement with Zoom may have rights to receive advance notice of subprocessor changes and to object to those changes, with the specific mechanism and timeline governed by that separate agreement rather than by this list.

Added July 6, 2026 Rare
Multi-Region Data Processing Location Disclosure

The document discloses the country or region in which each listed subprocessor processes data, identifying processing locations including the United States, countries within the European Union, and other regions, establishing the geographic scope of Zoom's subprocessor data processing chain.

Added July 6, 2026 Rare
AI-Function Subprocessor Inclusion

The subprocessor list includes vendors engaged for AI-related processing functions in connection with Zoom's services, meaning customer data may be processed by third-party AI infrastructure or tooling providers as part of Zoom's AI feature delivery.

Added July 6, 2026 Rare
Zoom Affiliates as Data Processors

In addition to third-party vendors, the document discloses Zoom-affiliated entities that act as processors of customer data, identifying the corporate group members through which Zoom delivers its services and within which customer data may flow.

Added July 6, 2026 Rare