Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
OneTrust is authorized to process name, email address, account type, country, IP address, DSAR reports, and user cookie preferences for the purpose of managing data subject access requests and cookie preference selections, with processing in the United States under SCCs.
This analysis describes what Zoom's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
DSAR reports processed by OneTrust may contain aggregated personal data about the requesting individual compiled in response to data subject access requests under GDPR or CCPA; the processing of these reports by a US-based subprocessor under SCCs is a material consideration for data controllers assessing whether their data subject rights fulfillment process involves adequate transfer safeguards.
Under this provision, personal data submitted through Zoom's data subject access request portal and cookie preference center, including name, email, IP address, and DSAR report content, is processed by OneTrust in the United States under Standard Contractual Clauses. This provision directly affects the mechanism through which individuals exercise data subject rights with Zoom.
Cross-platform context
See how other platforms handle OneTrust Data Subject Request Processing and similar clauses.
Compare across platforms →Monitoring
Zoom has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"OneTrust Data Subject Requests Portal, Cookie Preference Center Name Email address Account type Country IP address DSAR reports User cookie preferences United States SCCsExcerpt from Zoom's Sub-Processors
1) REGULATORY LANDSCAPE: This provision engages GDPR Articles 15-22 (data subject rights) and Chapter V (international transfers) given that DSAR reports containing personal data are transferred to OneTrust in the United States under SCCs. CCPA also creates data subject rights obligations relevant to US residents whose DSAR submissions are processed by OneTrust. The inclusion of DSAR reports as a data category processed by OneTrust means that the very mechanism for exercising privacy rights itself involves a third-party subprocessor and an international transfer. 2) GOVERNANCE EXPOSURE: Medium. The use of a specialist DSAR management platform is standard practice, but compliance teams should confirm that OneTrust's processing of DSAR reports is reflected in their vendor risk assessments and that the SCC mechanism is supported by adequate supplementary measures for transfers of personal data compiled in response to access requests. 3) JURISDICTION FLAGS: EU and EEA data subjects exercising GDPR rights have their request data transferred to the US; this is a standard practice but should be reflected in privacy notices. California residents exercising CCPA rights should be aware that their request data is processed by OneTrust under Zoom's direction. Organizations with specific data minimization requirements should assess whether the categories processed by OneTrust are limited to what is necessary for DSAR fulfillment. 4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should confirm that OneTrust is reflected in their Zoom DPA as an authorized subprocessor for DSAR and cookie consent management. Organizations that operate their own OneTrust instances should note that Zoom's use of OneTrust is a separate subprocessor relationship under Zoom's data controller authority. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that privacy notices disclose OneTrust's role in processing data subject requests. Records of Processing Activities should reflect OneTrust as a subprocessor for DSAR management. Cookie consent records managed through OneTrust's Cookie Preference Center should be reviewed to confirm they are maintained in accordance with applicable ePrivacy and GDPR requirements.
DSAR reports processed by OneTrust may contain aggregated personal data about the requesting individual compiled in response to data subject access requests under GDPR or CCPA; the processing of these reports by a US-based subprocessor under SCCs is a material consideration for data controllers assessing whether their data subject rights fulfillment process involves adequate transfer safeguards.
Under this provision, personal data submitted through Zoom's data subject access request portal and cookie preference center, including name, email, IP address, and DSAR report content, is processed by OneTrust in the United States under Standard Contractual Clauses. This provision directly affects the mechanism through which individuals exercise data subject rights with Zoom.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Zoom.