gdpr
Spotlight on data protection
Meet the highest bar in Europe
Get in-region data protection with Intelligent Content Management
At Box, securing our customers’ content is our top priority. Whether you're looking to process and/or transfer your data from the European Economic Area (EEA) or the United Kingdom (U.K.), we're here to help you with your data protection obligations. We pair our seamless end-user experience with an unmatched level of frictionless security, enhanced visibility, and meticulous control.
The global impact of Europe's data protection laws
The European Union GDPR and U.K. Data Protection Act harmonizes data privacy laws and regulations across the region, enhances data protection for E.U. and U.K. data subjects, and reshapes the way organizations approach data privacy. If you do business in E.U. or U.K., you'll need to comply with these data protection laws. Below we've outlined the recent evolution of data privacy regulations and guidance, as well as the steps we've taken to ensure we offer the privacy, security, and compliance you need.
The EU-U.S. DPF, UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF were respectively developed by the U.S. Department of Commerce and the European Commission, UK Government, and Swiss Federal Administration to provide U.S. companies like Box with reliable mechanisms for personal data transfers. To view our certifications, click here.
Box was among the first cloud content management platforms to have its Processor and Controller Binding Corporate Rules (BCRs) approved by European regulators in 2016. Today, we maintain Processor and Controller BCRs for both the EU and UK — the platinum standard in regional data protection. Learn more on our Regional Information Page.
The EU AI Act and GDPR set the benchmark for building AI that is safe, transparent and respectful of personal data. At Box, we’ve built privacy, security and AI Governance into Box AI. To learn more, visit our Box AI Trust webpage.
Strong AI governance is the key to unlocking innovation while managing risk. It’s about setting clear policies, oversight, and safeguards so AI works as intended. At Box, we see governance not as a hurdle, but as the foundation for building AI our customers can trust. To learn how you can set up your own AI governance program, click here.
Request to Sign your DPA
Box is committed to protecting the privacy of personal data. No matter the changing landscape, including the CJEU's Schrems II decision to invalidate Privacy Shield, the United Kingdom’s departure from the European Union (Brexit) or the issuance of updated SCCs by the European Commission, we’ve made it easy for our customers to maintain a lawful data transfer mechanism.
To offer the most flexible options to customers when it comes to transfers of personal data, our Data Processing Addendum (DPA) includes the updated EU SCCs issued on June 27, 2021 by the European Commission and the UKSCCs issued by the UK's Information Commissioner's Office (ICO) on March 21, 2022. To review Box's DPA, click here. To begin the DPA signature process, please submit your request via the link below and our team will respond promptly with any additional information required.
Our commitment to data privacy in the AI-first era
At Box, ensuring the privacy and security of our customer’s content is a foundational principle at the heart of our intelligent content management platform. We believe that Box AI unlocks powerful new ways for customers to engage with their content – and recognize that adopting generative AI technology introduces new responsibilities and risks that must be addressed thoughtfully and transparently.
As AI regulations continue to take shape globally, we know you may have questions about how Box fits into the evolving regulatory landscape – especially under frameworks like the European Union’s Artificial Intelligence Act (EU AI Act). That's why we've published a new knowledge paper: “The EU AI Act & Box AI: Building Privacy, Compliance, and Trust". To request the knowledge paper, please contact us at privacy@box.com.
How our products help you maintain seamless compliance
Box Zones
Helping you comply with multi-regional data residency requirements.
Box KeySafe
Enhance your encryption key management strategy.
Box Governance
Meet data retention obligations.
Box Shield
Detect and protect against malware attacks.
Data protection beyond Europe
US State Privacy Laws
At Box, we understand that compliance with U.S. state privacy laws can be a challenge. Our platform provides secure content management, collaboration, and workflow capabilities that help us maintain our own compliance with various state privacy regulations, including the California Consumer Privacy Act (CCPA), Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, and Utah Consumer Privacy Act. Our updated US Data Processing Addendum includes specific provisions relevant to these evolving state privacy laws, reflecting our commitment to protecting customer data and maintaining transparency as privacy regulations continue to advance at both federal and state levels. To learn more about Box's US state privacy compliance efforts, click here.
Asian Pacific Economic Cooperation (APEC) & Beyond
Box is proud to be certified under the APEC and Global Cross-Border Privacy Rules (CBPR), Privacy Recognition for Processors (PRP) systems, the gold standard in regional data privacy compliance. Maintaining compliance with these frameworks ensures personal data is protected as it's transferred among the participating countries. To learn more about Box's APEC and Global CBPR/PRP certifications, please visit our regional information page.
To learn more about Box's ongoing commitment to privacy, security, and compliance, please visit our Trust Center.
FAQ
Does Box maintain privacy and information security certifications?
Box maintains an array of certifications that supports customers in the European Economic Area (EEA), United Kingdom (U.K.) and elsewhere. We proudly adhere to many of the most comprehensive privacy and information security certifications, like Germany’s Cloud Computing Compliance Controls Catalogue (C5), the Trust Cloud Data Protection Profile (TCDP), and Binding Corporate Rules (BCRs). To learn more, please visit our compliance page.
What is Box KeySafe?
At Box, we understand that encryption key management is fundamental to your company’s data privacy and security program. In addition to providing you with industry leading privacy and security controls as part of core Box functionalities, you may choose to adopt the add-on product offering, Box KeySafe. Box KeySafe builds on strong encryption and security capabilities to offer you complete, independent control over your encryption keys. All key usage is unchangeable and includes a detailed, auditable record of key usage so you can track exactly why the keys are being accessed. With KeySafe, you can immediately revoke access to content with no impact to the Box platform’s usability, mobility, security, or governance.
What proactive steps has Box taken to further establish technical and organizational safeguards in response to the supplementary measures and essential guarantees guidance issued by the European Data Protection Board (EDPB)?
Following the issuance of the finalized European Data Protection Board (EDPB) guidance on June 21, 2021, we recognize that our customers may have additional questions about how Box safeguards customer personal data.
To support our customers in meeting their due diligence obligations as controllers under General Data Protection Regulation (GDPR), and to comply with our own Article 28 obligations as a processor, we've issued a Due Diligence and Supplementary Measures Report that is available upon request. This report includes detailed information regarding the technical and organizational safeguards Box currently has in place, the lawful data transfer mechanisms Box utilizes, and how we handle public authority requests while maintaining compliance with GDPR.
To request the report, please contact privacy@box.com.
How does Box safeguard my personal data?
We respect the privacy rights of users and recognize the importance of protecting your information. To learn more about how information is collected, retained, used, disclosed, and transferred by Box, take a look at our privacy notice.
What steps has Box taken to protect personal information following the Court of Justice of the European Union (CJEU) July 2020 decision to invalidate the adequacy of Privacy Shield in the "Schrems II" case?
Early on, we made a commitment to offer customers a cloud content management platform and product offering that not only met, but surpassed, industry standards. We've also historically offered customers an overlapping set of legal mechanisms and frameworks for data transfers outside of the EEA. These mechanisms include (1) Controller and Processor Binding Corporate Rules (BCRs), and (2) SCCs. And, while the CJEU invalidated Privacy Shield as a valid data transfer mechanism, we will continue to adhere to the Privacy Shield principles and the annual independent assessment performed to ensure compliance. To learn more about our continued dedication to safeguarding your data and our ongoing commitment to data privacy protection, check out our blog post.
Does Box use subprocessors?
Box uses the subprocessors identified on our subprocessors page to assist with data processing activities. This page outlines the services each subprocessor provides and the location of service, along with the due diligence procedures we perform prior to engaging any subprocessor. Subprocessors are strictly prohibited from using customer data, content, or personal data for any purpose other than to support Box in providing the service to its customers.