Privacy and Data Protection
Questions and Answers for Salesforce Customers:

European Court of Justice’s Decision Regarding the EU-US Safe Harbor Framework

At Salesforce, trust is our #1 value and nothing is more important than the success of our customers and the privacy of our customers’ data. In light of the European Court of Justice’s decision on October 6, 2015, regarding the EU-US Safe Harbor Framework, Salesforce is immediately offering customers a data processing addendum incorporating the European Commission’s standard contractual clauses, commonly referred to as “model clauses.”

What did the European Court of Justice decide regarding the EU-US Safe Harbor Framework?

On October 6, 2015, the European Court of Justice determined that the EU-US Safe Harbor Framework does not provide a valid legal basis for transfers of personal data from Europe to the U.S.

What is the EU-US Safe Harbor Framework?

The EU-US Safe Harbor Framework was established by the European Commission and the U.S. Department of Commerce in 2000 to facilitate transfers of personal data from the EU to eligible U.S. companies that certify to and comply with the Safe Harbor principles. Additional information about the EU-US Safe Harbor Framework is available at the U.S. Department of Commerce’s Web site.

What does the European Court of Justice’s decision mean for my company’s use of Salesforce services?

Trust is Salesforce’s #1 value and nothing is more important than the success of our customers. To ensure that our customers may continue to validate transfers of personal data from Europe to the U.S. under EU data protection laws, Salesforce is immediately offering its customers a data processing addendum incorporating the European Commission’s standard contractual clauses commonly known as “model clauses.” Please note that the model clauses will apply to the extent there is not another legal basis in place to validate the transfer of personal data from the EU to the U.S.

What are the model clauses?

The model clauses are contract templates developed by the European Commission as one mechanism for contracting parties to legalize the cross-border transfer of personal data from Europe. Salesforce’s new data processing addendum automatically incorporates the model clauses as long as transfers of personal data are not legalized by an alternative compliance standard recognized by the European Commission.

How does my company incorporate model clauses into my Salesforce contract?

Customers should promptly complete, sign and return Salesforce’s new data processing addendum to dataprocessingaddendum@salesforce.com.

Is the Data Processing Addendum available in any other languages?

This FAQ and the Data Processing Addendum is available in certain other languages at http://www.salesforce.com/company/legal/agreements.jsp.

What if I have additional questions?

Please open a case with the Salesforce customer support team via the Help & Training success community at Help.Salesforce.com.