Oracle is authorized to process real-time meeting traffic, recordings, transcriptions, uploaded files, and AI-related Customer Content in Mexico, the United States, and Saudi Arabia, with Binding Corporate Rules as the stated international transfer mechanism.
This analysis describes what Zoom's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Oracle is the only subprocessor in this document using Binding Corporate Rules rather than Standard Contractual Clauses as the transfer mechanism, and Saudi Arabia is included as a processing location; Saudi Arabia is not an EU-recognized adequacy country, and BCR coverage of transfers to Saudi Arabia requires confirmation that Oracle's approved BCRs explicitly cover this jurisdiction.
Interpretive note: Whether Oracle's Binding Corporate Rules explicitly cover transfers to Saudi Arabia cannot be confirmed from this document alone; verification requires review of Oracle's approved BCR documentation.
Under this provision, Customer Content including real-time meeting traffic, recordings, transcriptions, and AI-processed content may be processed by Oracle in Saudi Arabia. The agreement states Binding Corporate Rules as the transfer mechanism, which differs from the SCC mechanism used for all other subprocessors in the list.
Cross-platform context
See how other platforms handle Oracle Processing in Saudi Arabia via BCRs and similar clauses.
Compare across platforms →"Oracle Cloud Service Provider Real-time meeting and webinar traffic Meeting and call recordings address Transcriptions of meeting or call recordings Uploaded files Customer Content and context for AI processing if AI features are enabled Mexico, United States, Saudi Arabia Binding Corporate Rules (BCRs)Excerpt from Zoom's Sub-Processors
1) REGULATORY LANDSCAPE: This provision engages GDPR Chapter V international transfer requirements.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Oracle is the only subprocessor in this document using Binding Corporate Rules rather than Standard Contractual Clauses as the transfer mechanism, and Saudi Arabia is included as a processing location; Saudi Arabia is not an EU-recognized adequacy country, and BCR coverage of transfers to Saudi Arabia requires confirmation that Oracle's approved BCRs explicitly cover this jurisdiction.
Under this provision, Customer Content including real-time meeting traffic, recordings, transcriptions, and AI-processed content may be processed by Oracle in Saudi Arabia. The agreement states Binding Corporate Rules as the transfer mechanism, which differs from the SCC mechanism used for all other subprocessors in the list.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Zoom.