GDPR Compliance

What is GDPR?

The GDPR is a comprehensive data protection law that regulates the use of personal data of EU residents and provides individuals rights to exercise control over their data.

Who must comply with GDPR?

The GDPR does not only apply to European companies, it extends to any organization worldwide that targets or offers services or products to EU residents.

Does GDPR impact ThoughtSpot Customers?

ThoughtSpot customers and their data only come within the purview of GDPR when ThoughtSpot processes personal data, which is defined rather broadly. “Processing” includes the collection, storage, transfer, or use, of personal data.

Does GDPR require information to stay or be stored within the EU?

No. GDPR does not require any data localization or data residency for data. Simply put, any EU personal data you transfer out of the EU, must have the same level of protection it gets under GDPR. This can be achieved through a number of legal frameworks, which ThoughtSpot abides by for the transfers.

Does ThoughtSpot utilize sub-processors to process personal data for the provision of ThoughtSpot SaaS applications?

Yes, ThoughtSpot engages sub-processors pursuant to a data transfer agreement for the provision of ThoughtSpot SaaS applications after thorough review and approval. A list of those authorized sub-processors can be found here.

Is ThoughtSpot GDPR compliant?

Yes. ThoughtSpot constantly evaluates and revises the implemented security and privacy programs to ensure that ThoughtSpot and its customers remain compliant with GDPR with the use of ThoughtSpot Cloud.

The Data Processing Addendum (“DPA”) is an agreement that sets out the legal framework under which ThoughtSpot processes Personal Data. The DPA is an addendum to the ThoughtSpot Cloud Subscription Agreement between ThoughtSpot and our customer, and forms part of the customer agreement.

The DPA is specific to ThoughtSpot’s multi-tenant services and covers the specific processes and procedures related to the way in which the services and infrastructure work. The DPA is also drafted to be consistent with the customer agreement and other relevant documentation.

A copy of the Data Processing Addendum can be found here or you may ask your ThoughtSpot Account Executive for more information.