General Data Protection Regulation (GDPR)
In July 2020, the Court of Justice of the European Union issued a decision in Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems (“Schrems II”), in which it held, among other things, that (1) the U.S.’s Privacy Shield program could no longer be used for data transfers to the U.S., and (2) the transfer mechanisms identified in the GDPR — including the European Commission-issued Standard Contractual Clauses (“SCCs”) — could only be used where the laws and practices in the data importer’s country do not impinge on the protections provided by the transfer tool.
Transfer Impact Assessment
In July 2020, the Court of Justice of the European Union issued a decision in Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems (“Schrems II”), in which it held, among other things, that (1) the U.S.’s Privacy Shield program could no longer be used for data transfers to the U.S., and (2) the transfer mechanisms identified in the GDPR — including the European Commission-issued Standard Contractual Clauses (“SCCs”) — could only be used where the laws and practices in the data importer’s country do not impinge on the protections provided by the transfer tool.
As a result of the decision, organizations are required to carry out assessments of the laws and practices in the countries they transfer data to. And if you use Datadog as a vendor, that means assessing transfers to Datadog in the United States. On this page, we have added a summary of data transfers at Datadog. Additionally, we put together an Assessment to provide you with the information needed for you to perform your own transfer assessment.
International Data Transfers
Datadog is based in the United States and operates globally. As a result, your personal data may be transferred to, and processed in, any country where we operate or where our service providers operate, including the United States.
We protect your personal data in accordance with our Privacy Policy no matter where it is transferred or processed. If you are located in the EEA, UK, or Switzerland, and your personal data is transferred to a country that has not been recognized as providing an adequate level of data protection by the relevant data protection authorities, the transfer will only be made when protected under the European Commission’s approved standard contractual clauses, amended as needed to satisfy country-specific requirements. To learn more about our international data transfers, please see our EEA Data Transfers FAQs.
In order to ensure that all transfers of personal data to Datadog are made under a GDPR-compliant transfer mechanism, we will sign a Data Processing Addendum (“DPA”) with you that includes a section on international data transfers and that incorporates the European Commission-approved Standard Contractual Clauses (“SCCs”) or the UK’s International Data Transfer Addendum, as required.
For more information about transfers of personal data to Datadog, please refer to Schedule A of our DPA.
If you haven’t yet signed a DPA with us and believe that you need one, you can request a copy from your customer success manager or sales representative, as outlined in the link above.
Datadog’s Subprocessors
In order to provide our Services, including 24/7 support, we may disclose your data to certain of our trusted vendors (subprocessors). These onward transfers are only made in specific cases — for example, we may need to share your personal data with the cloud services provider you selected to host your data, or with one of our global affiliates in order to provide you with technical support after the close of business local time. At least 30 days before we engage a new subprocessor, we will add it to our Subprocessors List. You can subscribe to receive notifications of these updates by completing the form at the bottom of our Subprocessors List.
Before we engage a new subprocessor, we subject it to a rigorous vendor-onboarding process in order to ensure that we can safely provide it with the personal data we receive from our customers. This includes reviewing each vendor’s security and privacy practices to ensure that they meet our strict requirements, as well as requiring them to sign a DPA with us that (1) provides protections for personal data at least as protective as those in our DPA with you, and (2) includes the SCCs for any onward transfers of personal data.
California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
The CCPA is a landmark state law that established certain privacy rights and more control over the personal data for California consumers. Most notably, the CCPA includes an individual’s right to know, right to delete, right to opt-out, and right to non-discrimination. The CPRA expanded the CCPA to further privacy protections and expand the rights of California consumers in relation to their personal data.
For more information about how the CCPA applies to Datadog, please navigate here.
Health Insurance Portability and Accountability Act (HIPAA)
HIPAA is a US federal law that establishes national standards for protecting certain health data, Protected Health Information (PHI). For our HIPAA-regulated customers, Datadog may act as a business associate, and will sign a Business Associate Agreement (BAA) in order to protect any PHI transferred. Datadog’s HIPAA program extends to all of our HIPAA-Eligible Services.