Dutch Government DPIA Validates Salesforce Privacy and Compliance
Salesforce has received a positive outcome from an independent Data Protection Impact Assessment (DPIA) conducted on behalf of the Dutch government. The assessment highlights Salesforce’s strong privacy and data sovereignty controls and confirms that Sales Cloud and Service Cloud can be used in compliance with GDPR when the recommended measures are applied.
At Salesforce, trust is our #1 value, guiding everything we do—from our culture to our technology. That’s why we’re proud to announce the positive outcome of a comprehensive Data Protection Impact Assessment (DPIA) for our Sales and Service Cloud offerings. This extensive assessment was conducted from September 2022 to June 2025 by independent experts, Privacy Company and law firm Kennedy van der Laan, on behalf of the Dutch government’s Strategisch Leveranciersmanagement Rijk (SLM), with whom we have a long standing relationship.
We are thankful to the Dutch government, a leader on data privacy and protection within the European Union (EU), and their advisors for their constructive engagement in this process, which resulted in pro-privacy changes that will benefit our customers globally And confirms that when applying the recommended measures, Dutch government customers can use the tested services in compliance with GDPR under the improved enrollment framework with the Dutch government. We are excited and confident that this outcome will further strengthen Salesforce’s continued partnership with EU governments on digital transformation.
(The DPIA Report was published by SLM on August 11, 2026 and is available here.)
What is a DPIA and why does this matter?
A DPIA is a risk assessment that proactively identifies and addresses potential privacy risks. It involves a thorough technical and legal examination of data processing practices against EU data protection laws, including GDPR. An independent DPIA, particularly one conducted by a government body, provides a valuable benchmark for technology providers such as Salesforce.
The positive result of this DPIA is a testament to, and independent validation of, our unwavering commitment to privacy and customer success.
Keep greater control of your data in the EU
With Hyperforce EU Operating Zone, Salesforce helps organizations keep Customer Data in the EU and maintain greater control over where data is processed. Learn how these capabilities can support your data residency, privacy, and compliance requirements.
Key takeaway: Robust sovereignty controls for Customer Data
The report positively highlights several key strengths of our services, most notably the suitability of our data localization controls, such as our EU Operating Zone (EUOZ), as a means to ensure Customer Data remains in the EU. We are proud of and have invested heavily in such controls, and plan to continue to invest.
Our enduring commitment to customer trust and success
Privacy is ever evolving and our close collaboration with the Dutch government and their advisors provided valuable feedback that directly led to the further strengthening of Salesforce’s privacy posture.
Salesforce is dedicated to continuously advancing our offerings to help our customers succeed while upholding the fundamental right to privacy. This DPIA is a significant milestone that underscores our steadfast dedication to privacy, transparency, and compliance. We are proud to provide our customers with services that not only meet the highest standards of data protection but are also independently validated as a trusted solution by discerning public sector customers like the Dutch government.
To learn more about how Salesforce can support your organization’s privacy and compliance objectives, reach out to our team today.
