Google Cloud Subprocessors List (November 2026): Changes and History

Google Cloud subprocessors (November 2026)

Key DPA terms at Google Cloud

What Google Cloud's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification

Without undue delay, with no set deadline

“Google will notify Customer promptly and without undue delay after becoming aware of a Data Incident, and promptly take reasonable steps to minimize harm and secure Customer Data.”

DPA, cloud.google.com ↗

Notice of a new subprocessor

30 days ahead

“Google will, at least 30 days before the New Subprocessor starts processing any Customer Data, notify Customer of the engagement”

DPA, cloud.google.com ↗

Transfers outside the EU

Standard contractual clauses and adequacy decisions

“"SCCs" means the Customer SCCs or SCCs (Processor-to-Processor, Google Exporter), as applicable.”

“The parties acknowledge that European Data Protection Law does not require SCCs or an Alternative Transfer Solution in order for Customer Personal Data to be processed in or transferred to an Adequate Country.”

DPA, cloud.google.com ↗

Customer data after the contract ends

Deleted within 180 days of the contract ending

“Google will comply with this Instruction as soon as reasonably practicable and within a maximum period of 180 days, unless European Law requires storage, where European Data Protection Law applies, or applicable law requires storage, where any other Applicable Privacy Law applies.”

DPA, cloud.google.com ↗

Audit rights

On request

“Google will, if required under Applicable Privacy Law, allow Customer or an independent auditor appointed by Customer to conduct audits (including inspections) to verify Google's compliance with its obligations under this Addendum in accordance with Section 7.5.3 (Additional Business Terms for Reviews and Audits).”

DPA, cloud.google.com ↗

Documents we track for Google Cloud

AI terms

checked November 9, 2026 changed November 1, 2026 cloud.google.com ↗

DPA

checked November 9, 2026 changed November 1, 2026 cloud.google.com ↗

Privacy policy

checked November 9, 2026 cloud.google.com ↗

Subprocessor list

checked November 9, 2026 changed October 20, 2026 cloud.google.com ↗

Terms of service

checked November 9, 2026 changed October 14, 2026 cloud.google.com ↗

Change history

1. November 1, 2026

   DPA changed

   A new product-specific addendum for Google Cloud Universal Ledger (GCUL) has been added, under which Transaction Data cannot be deleted by either Customer or Google during or after the Term, and the Addendum remains in effect until all other Customer Data is deleted; customers are also required not to include personal data in Transaction Data.

2. November 1, 2026

   AI terms changed

   A new Section 56, "Google Cloud Universal Ledger (GCUL)", is added to the Service Specific Terms, introducing blockchain/Web3 terms stating that Transaction Data "cannot be deleted or amended", that Google bears no responsibility or liability for cryptographic key compromise or disputes between domain participants, and that customers are solely responsible for key security and regulatory compliance; later sections renumber accordingly (Free Evaluation Services becomes Section 57, Delivery Navigator Section 58). Separately, the data Google shares with Palo Alto Networks for Advanced WildFire...

3. October 28, 2026

   AI terms changed

   A new subsection 9(b) 'Advanced WildFire' was added to the Cloud NGFW/Cloud IDS section, disclosing that Google shares Customer information (organization name, Project name, files identified for malware scanning, and in some cases contact details) with Palo Alto Networks for Cloud NGFW Enterprise's Advanced WildFire feature, and that once transferred, Google's Cloud Data Processing Addendum no longer applies to that data, which is instead governed by the PANW EULA's 'Data Terms; Confidentiality' section.

4. October 20, 2026

   Location changed

   Google Cloud now lists NTT DATA Americas, Inc. in India, Malaysia, United States of America (before: United States of America).

5. October 16, 2026

   AI terms changed

   A new "Commitment Drawdown" clause has been added stating that usage of Third-Party Enterprise Models in Applicable Services will count as Google Cloud Marketplace purchases toward the cumulative cap under the Google Cloud Marketplace Commitment Drawdown Policy.

6. October 14, 2026

   Terms of service changed

   Section 3.3 (Restrictions) and Section 13.2 (Customer Indemnification Obligations) now explicitly extend to "AI Agent" usage, a new defined term added to the definitions section pointing to Service Specific Terms, and the "Export Control Laws" definition is broadened from "export and re-export control laws" to "export control and sanctions laws".Customers using Google's AI Agent features are now subject to the same use restrictions and indemnification obligations that previously applied only to Services.

7. October 14, 2026

   AI terms changed

   The service terms add new sections for "Google Frontier Models" and "Google Frontier Cyber Models" that instruct Google to store prompts and Generated Output for up to thirty (30) days to run automated safety/compliance review before deletion, broaden Google's liability/indemnity disclaimers to cover Customer AI Agents, Third-Party AI Agents and Third-Party Services, and extend Google's IP ownership to include "Google AI Agents" in addition to Google Models."Gemini Cyber" is renamed "Google Cyber Models" and new Agentic AI Service safeguard provisions shift liability to the customer for dis...

8. October 10, 2026

   AI terms changed

   A new Section 3.c "Conversational Analytics" is added to the AI terms, instructing Google to machine-process Customer Data submitted to BigQuery Conversational Analytics to generate anonymous, aggregated data for providing and improving that service (troubleshooting, upkeep, and feature improvement), with an opt-out available and specific conditions determining whether opt-out or opt-in applies.

9. October 2, 2026

   AI terms changed

   A new Section 52 'Spanner Omni' was added with the same free-use/Premium Purposes licensing terms as AlloyDB Omni, shifting AlloyDB Omni to Section 53 and renumbering all subsequent sections through 56; the 'Last modified' date also moved to September 30, 2026.

Tracking since September 25, 2026. Every change links to the two versions of the document it came from. All vendors' changes →

Google Cloud subprocessors FAQ

How many subprocessors does Google Cloud use?

Google Cloud lists 109 subprocessors on its published list, including Accenture International Limited, Bristlecone Incorporated, Canonical Group Limited, Cognizant Worldwide Limited, and CData Software, Inc. and 104 more.

Where does Google Cloud process customer data?

The subprocessors named by Google Cloud are located in United States of America, India, Canada, Japan, Mexico, and Poland and 44 other locations, as stated on its list.

How quickly does Google Cloud report a personal data breach to customers?

According to its DPA, Google Cloud reports a personal data breach to customers without undue delay, with no set deadline: “Google will notify Customer promptly and without undue delay after becoming aware of a Data Incident, and promptly take reasonable steps to minimize harm and secure Customer Data.”

How much notice does Google Cloud give before adding a subprocessor?

Google Cloud's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “Google will, at least 30 days before the New Subprocessor starts processing any Customer Data, notify Customer of the engagement”

How does Google Cloud transfer personal data outside the EU?

Google Cloud's DPA relies on standard contractual clauses and adequacy decisions: “"SCCs" means the Customer SCCs or SCCs (Processor-to-Processor, Google Exporter), as applicable.”

When was Google Cloud's subprocessor list last checked?

ClauseTrail last checked Google Cloud's subprocessor list on November 9, 2026 and last saw it change on October 20, 2026. Lists are re-checked daily.

How do I find out when Google Cloud adds or removes a subprocessor?

ClauseTrail monitors Google Cloud's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.