Snapshot 73924
Normalized text
Scripts and page chrome removed; this is what change detection compares.
RUBRIK, INC.
DATA PROCESSING ADDENDUM
This Data Processing Addendum (“DPA”) forms part of the Agreement and reflects the Parties’ agreement with respect to the Processing
of Customer Data (including Personal Data) in the provision of the Rubrik Service pursuant to the Agreement. This DPA consists of: (i)
Exhibit 1 – Description of Processing of Personal Data; and if applicable; (ii) Standard Contractual Clauses with Annexes I-IV (“SCCs”),
which shall be applicable to international transfer of Personal Data from the European Economic Area (“EEA”) to Rubrik located in a third
country; and (iii) the UK Addendum to the SCCs, which shall be applicable to any international transfer of Personal Data from the UK to
Rubrik located in a third country.
In the event of any conflict or inconsistency between the terms of the Agreement and this DPA, the terms of this DPA shall prevail. For
clarity, the terms of the SCCs shall prevail over any other term in this DPA, with respect to Processing Personal Data. All capitalized
terms not defined herein shall have the meaning set forth in the Agreement.
1. DEFINITIONS.
1.1 “Controller” means the entity which determines the purposes and means of the Processing of Personal Data.
1.2 “Business Contact Data” means the names, addresses, email, and telephone numbers and all other business-related
information of each Party’s personnel, that may be collected or exchanged between the Parties in the ordinary course of maintaining the
business relationship, including administration and use of the Rubrik Service, such as contract management, sales and ordering, and
business development.
1.3 “Customer Data” means content and application data uploaded by or on behalf of Customer for hosting in and processing by
the Rubrik Service.
1.4 “Data Protection Laws” means all laws and regulations, including laws and regulations of the European Union, the EEA and
its member states, Switzerland, the United Kingdom, and the United States, (including without limitation, the U.S. Data Protection Laws)
applicable to the Processing of Personal Data under this DPA. For the avoidance of doubt, if Rubrik’s Processing involving Personal Data
is not within the scope of a given Data Protection Law, then such law is not applicable for purposes of this DPA.
1.5 “Data Subject” means the identified or identifiable person to whom Personal Data relates.
1.6 “GDPR” means as applicable: (i) the Regulation (EU) 2016/679 (General Data Protection Regulation) of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the Processing of Personal Data and
on the free movement of such data and repealing Directive 95/46/EC (“EU GDPR”); and (ii) the EU GDPR, as incorporated into the laws
of the United Kingdom under the European Union (Withdrawal) Act 2018 (“UK GDPR”), in each case as may be amended or superseded
from time to time.
1.7 “Personal Data”, “Personal Information”, and/or “Personally Identifiable Information”, which shall be referred to
individually or collectively in this DPA as “Personal Data”, means the Customer Data that is also (i) any information relating to an
identified or identifiable natural person; and/or (ii) any information that identifies, relates to, describes, or could reasonably be linked,
directly or indirectly, with a particular consumer or household, in each case that is owned or controlled by Customer. Personal Data
does not include data that is anonymized data unless otherwise required by applicable Data Protection Laws.
1.8 “Processor” means an entity which is Processing Personal Data on behalf of the Controller.
1.9 “Process” or “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not
by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation,
use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or
destruction.
1.10 “Security Breach” means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to
Customer Data, arising out a breach of Rubrik’s obligations set forth in the Data Security Schedule found here:
https://www.rubrik.com/en/legal.
1.11 “Standard Contractual Clauses” or “SCCs” or “Approved EU SCCs” means: (i) where the EU GDPR applies, the Standard
Contractual Clauses, as described in Article 46 of the EU GDPR and approved by the European Commission decision 2021/914/EC,
dated 4 June 2021, found at https://www.rubrik.com/en/legal/SCC; (ii) where the Swiss Data Protection Act applies, the applicable
Rubrik Customer DPA (v09252026) CONFIDENTIAL 1
standard data protection clauses issued, approved or otherwise recognized by the Swiss Federal Data Protection and Information
Commissioner (“FDPIC”) (the “Swiss SCCs”); and (iii) or any set of clauses later approved by the European Commission which amend,
replace or supersede such version.
1.12 “Subprocessor” means any party engaged by Rubrik to Process Customer Data.
1.13 “Supervisory Authority” means an independent public authority which is established by an EU Member State pursuant to the
GDPR.
1.14 “UK” means the United Kingdom of Great Britain and Northern Ireland.
1.15 “UK Addendum” means the template addendum issued by the UK ICO and laid before the UK Parliament in accordance with
s119A of the Data Protection Act 2018 on 2 February 2022, as revised under Section 18, which amends the SCCs and can be found here:
https://www.rubrik.com/en/legal/SCC.
1.16 “U.S. Data Protection Laws” means any applicable United States (U.S.) privacy law or U.S. state privacy law or regulations
relating to the protection of Personal Data, whether in existence as of the Effective Date or promulgated thereafter, as amended or
superseded, subject to Section 13 (Changes in Law) herein.
2. SCOPE. Customer authorizes Rubrik to process Customer Data to provide the Rubrik Service, Support Services and
Professional Services in accordance with Customer’s documented instructions and the terms of this DPA. Unless otherwise set forth in
this DPA, Sections 3 through 13 of this DPA apply to the Processing of Personal Data, to the extent required by applicable Data Protection
Laws.
2.1 Business Contact Data. Each Party may use the Business Contact Data of the other Party for the purposes of the business
relationship including access to the Rubrik Service, consistent with applicable Data Protection Laws and internal policies. Unless
otherwise prohibited by applicable Data Protection Laws, the receiving Party may transfer such Business Contact Data to, or access
such Business Contact Data from, any country in which such Party or its Affiliates conduct business relating to this Agreement. Each
Party will use reasonable and appropriate security measures to protect such Business Contact Data. Each Party is independently
responsible, as a Controller, for meeting its own transparency and notice obligations to Data Subjects under applicable Data Protection
Laws with respect to its Processing of the other Party's Business Contact Data. Rubrik’s transparency and notice obligations are set forth
in its privacy policy located at the Rubrik Site.
2.2 Personal Data. The Parties acknowledge and agree that with respect to Processing Personal Data, Rubrik is the Processor and
Customer is either a Controller or Processor of Personal Data. Rubrik or its Subprocessors may Process Personal Data in the course of
providing the Rubrik Service, to deliver the functional capabilities of the Rubrik Service pursuant to the Customer Instructions (as defined
below), and in accordance with applicable Data Protection Laws. Rubrik will Process Personal Data for the Term of the Agreement,
unless otherwise agreed to by the Parties in writing or pursuant to a requirement under Data Protection Laws. The categories of Data
Subjects, the categories of Personal Data, and the nature and purpose of Processing are set forth in Exhibit 1 of this DPA and Annex I to
the SCCs, as applicable. To the extent that Customer is a “covered entity” or a “business associate”, as such terms are each defined in
the Health Insurance Portability and Accountability Act of 1996, as amended, and the regulations promulgated thereunder (collectively
“HIPAA”), and the Personal Data includes “protected health information” as defined under HIPAA, then execution of the Agreement to
which this DPA is incorporated includes execution of the HIPAA Business Associate Agreement (“BAA”) found on the Rubrik Site.
2.3 Service Data.
(a) Rubrik may collect and use data generated by the Rubrik Service in connection with Customer's use thereof, including usage
and capacity metrics; performance characteristics; threats and anomalies; configuration and diagnostic information; and
administrative user interactions with the Rubrik Service (“Service Data”) for the following purposes: (a) service operations,
including improving, maintaining, and securing the Rubrik Service; (b) troubleshooting, and problem resolution; and (c) business
operations, including billing, account management, internal reporting, business modeling, and financial reporting. Rubrik will
not share Service Data that includes Customer’s Confidential Information with a third party except in accordance with the
confidentiality obligations under the Agreement.
(b) Rubrik may create aggregated and de-identified or anonymized data (as applicable) derived from Service Data (“Enhancement
Data”). Rubrik may use Enhancement Data for product development and improvement and for analytical purposes.
3. CUSTOMER INSTRUCTIONS. The Parties acknowledge and agree that for the purposes of this DPA, Customer’s documented
instructions regarding the Processing of Customer Data include (i) the obligations and requirements set forth in this DPA and the
Rubrik Customer DPA (v09252026) CONFIDENTIAL 2
Agreement; (ii) the applicable Documentation; (iii) Customer’s use and configuration of the Rubrik Service; and (iv) any additional written
instruction Customer provides to Rubrik, which Rubrik agrees to in writing via an amendment to this DPA, regarding the Processing of any
Customer Data (collectively, the “Customer Instructions”). Customer acknowledges and agrees that the nature of the Rubrik Service
is such that it is unlikely Rubrik will be able to determine whether a Customer Instruction is potentially infringing upon an applicable Data
Protection Law. As such, Rubrik does not have a duty under this DPA to inspect each Customer Instruction to determine whether it
infringes any Data Protection Law. However, in the event Rubrik notifies Customer of any potential infringement of an applicable Data
Protection Law, the Parties will work together in good faith to resolve such issue in a timely manner. In no event will either Party be
required to perform any activity that violates any applicable Data Protection Law. Customer will be responsible for all liability for all
claims and damages arising from any Processing by Rubrik in accordance with a Customer Instruction.
4. RUBRIK’S OBLIGATIONS.
4.1 Security Obligations. Rubrik shall limit access to Customer Data to only those persons authorized by Rubrik to Process
Customer Data and who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
Rubrik will protect the confidentiality of Customer Data through implementing and maintaining the technical and organizational security
measures set out in the Data Security Schedule found here: https://www.rubrik.com/en/legal, (“Data Security Schedule”) which take
into account the state of the art of technology, the costs of implementation and the nature, scope, context and purposes of Processing,
and the risk of varying likelihood and severity for the rights and freedoms of natural persons, and offers a level of security appropriate to
the risk of the Processing of Customer Data.
4.2 Security Breaches. Rubrik shall notify Customer without undue delay, but in no event more than seventy-two (72) hours after
becoming aware of any Security Breach, and Rubrik will take reasonable steps to: (i) identify the cause of such Security Breach; and (ii)
take the steps necessary and reasonable to remediate the cause of such Security Breach to the extent such remediation is within Rubrik's
reasonable control. To the extent Rubrik has the information, Rubrik will provide reasonable assistance to Customer with respect to
Customer’s obligations under applicable Data Protection Laws, including without limitation, Article 33(2) and (3) of the GDPR, for any
Personal Data Breaches as defined thereunder.
5. CUSTOMER’S OBLIGATIONS. Customer is solely responsible for the accuracy and legality of Customer Data provided to
Rubrik. When providing or making available Personal Data to Rubrik, Customer shall only disclose or transmit Personal Data that is
necessary for Rubrik to perform the Rubrik Service. Customer represents and warrants that it complies with all applicable Data
Protection Laws, including without limitation, possessing all necessary rights to provide the Personal Data to Rubrik for the Processing
to be performed in relation to the Rubrik Service and Customer agrees that it shall be responsible for obtaining all necessary consents
and providing all necessary notices to Data Subjects, as required under the relevant Data Protection Law. In addition, Customer is
responsible for determining whether the Rubrik Service is appropriate for the storage and Processing of Customer Data, including any
Personal Data that may be subject to specific Data Protection Law or regulation, as well as for the configuration and use of the Rubrik
Service, including any Customer Instructions, in a manner consistent with Customer’s legal and regulatory obligations.
6. AUDITS AND ASSISTANCE.
6.1 Audit Report. Rubrik undertakes to perform regular audits to verify its technical and organizational security measures. Such
audits will be conducted: (i) by a qualified independent third party; (ii) at least annually; (iii) in accordance with SOC 2 or ISO 27001
standards or substantially equivalent standards; and (iv) will result in an audit report (“Report”). Upon Customer's written request, and
subject to the confidentiality obligations set forth in the Agreement, Rubrik agrees to make available the Report and its applicable
certifications in order to demonstrate the technical and organizational security measures implemented by Rubrik.
6.2 Additional Audit Measures. In addition to the Report provided under Section 6.1, Rubrik will provide reasonable assistance to
Customer so that Customer may comply with Customer's obligations to perform a data protection impact assessment (or other
assessments required under applicable Data Protection Laws) related to Customer’s use of the Rubrik Service, to the extent Customer
does not otherwise have access to the relevant information and to the extent such information is available to Rubrik. Rubrik shall provide
reasonable assistance to Customer in the cooperation or prior consultation with the Supervisory Authority in relation to this DPA, to the
extent required by the GDPR. Further, Rubrik will take such steps as are reasonably required to assist Customer with its obligations under
Articles 28(3)(h) and 32 to 36 of the GDPR and/or any applicable Data Protection Laws taking into account the nature of the Processing.
7. DATA ERASURE. Consistent with the Agreement, Rubrik will return or delete all Customer Data following the termination of
the Agreement, unless such Customer Data is required to be maintained by Data Protection Laws, in which case it shall be held in
accordance with the terms of this DPA.
Rubrik Customer DPA (v09252026) CONFIDENTIAL 3
8. SUBJECT ACCESS REQUESTS. Taking into account the nature of the Processing related to the Rubrik Service, Rubrik will
reasonably assist the Customer with Data Subject requests. For the avoidance of doubt Rubrik will not respond directly to Data Subjects
requests, but to the extent legally permissible, Rubrik will advise the Data Subject to submit their request to Customer and Customer
will be responsible for responding to any such request.
9. SUBPROCESSORS. Customer provides its general authorization for Rubrik to retain its Affiliates and third parties as
Subprocessors in connection with the provision of the Rubrik Service, pursuant to the terms of this Section 9. Rubrik maintains a current
list of Subprocessors required to provide and maintain the Rubrik Service on the Rubrik Site, which can be found at
https://www.rubrik.com/en/legal/rubrik-subprocessors. Rubrik will only appoint new Subprocessors pursuant to applicable Data
Protection Laws, including Article 28(2) of the GDPR. At the url link set forth above, Customer will find a mechanism to subscribe to
receive notifications of new Subprocessors for the Rubrik Service, and if Customer subscribes, Rubrik shall provide notification of a new
Subprocessor(s) before authorizing any new Subprocessor(s) to Process Customer Data in connection with the provision of the Rubrik
Service. If Customer does not object to the appointment of any new Subprocessors within thirty (30) days after notification of such
appointment by Rubrik, Customer will be deemed as having provided its consent to the new appointment. Should Customer object
(acting reasonably) to a new Subprocessor Processing any Customer Data by providing written notice to Rubrik, Rubrik will use
reasonable efforts to make available to Customer a change in the Rubrik Service or recommend a commercially reasonable change to
Customer’s configuration or use of the Rubrik Service to avoid Processing of Customer Data by the objected-to new Subprocessor
without unreasonably burdening Customer. If Rubrik is unable to make available such change within a reasonable time period, which
shall not exceed thirty (30) days, Customer may terminate the Agreement with respect to any specific Rubrik Service that cannot be
provided without the objected-to new Subprocessor. Such termination right is Customer’s sole and exclusive remedy with respect to
such objection. Prior to engaging a Subprocessor to Process any Customer Data, Rubrik shall enter into a written agreement with such
Subprocessor in accordance with the requirements under Data Protection Laws and such obligations will in no event be less protective
than this DPA. Rubrik will restrict the Subprocessors' access to Customer Data to only that which is necessary to provide or maintain
the Rubrik Service. Rubrik will remain responsible for its compliance with the obligations of this DPA and for any acts or omissions of the
Subprocessors.
10. DATA TRANSFERS. If, in the performance of the Rubrik Service, Personal Data that is subject to Data Protection Laws having
extraterritorial transfer restrictions is transferred to a country that does not ensure an adequate level of data protection within the
meaning of the Data Protection Laws (a “Restricted Transfer”), the transfer mechanisms listed below shall apply to such transfers:
10.1 Rubrik Processor Binding Corporate Rules. Transfers of Personal Data outside the EEA to a third country that has not been
given adequacy by the European Commission, shall be subject to the Rubrik Processor Binding Corporate Rules (“BCR-P”) as approved
by the competent Supervisory Authority on 30 June 2026 and as amended from time to time in accordance with said rules, available
here: www.rubrik.com/legal/rubrik-binding-corporate-rules. The BCR-P are binding between the Parties and shall prevail in case of any
conflict between the BCR-P and this DPA. Where BCR-P is not applicable or where Customer elects an alternative transfer mechanism,
the Parties agree that the transfer mechanisms shown below, including the SCCs in Section 10.4, shall apply in the order set forth below.
10.2 EU-US, UK Extension and Swiss-US Data Privacy Framework. To the extent the BCR-P in Section 10.1 are not applicable or
have been deemed invalidated, and Personal Data is transferred from the European Union, United Kingdom, or Switzerland to the United
States, such transfers shall be subject to the EU-U.S. Privacy Framework (“DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-
U.S. DPF. Rubrik’s DPF certification confirms its obligation to ensure the lawful and secure Processing of Personal Data. Rubrik’s DPF
Notice can be found here: https://www.rubrik.com/content/dam/rubrik/en/resources/policy/data-privacy-framework-notice.pdf.
Rubrik’s DPF certification can be accessed here: https://www.dataprivacyframework.gov/s/participant-search. Where the DPF is not
applicable or has been deemed invalidated, the transfer mechanism in Section 10.3 shall apply.
10.3 APEC Privacy Recognition for Processors. Rubrik has obtained APEC Privacy Recognition for Processors (“PRP”)
certification. Where Rubrik Processes Personal Data within the scope of Rubrik’s APEC PRP certification, Rubrik shall perform such
Processing in a manner consistent with the APEC Cross Border Privacy Rules (“CBPR”) System requirements to the extent the
requirements are applicable to Rubrik’s Processing of the Personal Data. Rubrik’s APEC PRP Certification can be accessed here:
https://cbprs.org/compliance-directory/prp/.
10.4 Standard Contractual Clauses. To the extent that none of the preceding Sections 10.1 – 10.3 are applicable or have been
deemed invalidated, then Customer and Rubrik agree that transfers of Personal Data outside the EEA to a third country that has not been
given adequacy by the European Commission, shall be subject to module two of the Standard Contractual Clauses (Controller to
Processor) found here: https://www.rubrik.com/en/legal/SCC, or other permitted transfer mechanisms as allowed per the GDPR, to the
extent agreed between the Parties. For purposes of designating the roles of the Parties, as the Data Processor, Rubrik will be deemed
the data importer and Customer, as the Data Controller, will be deemed the data exporter under the SCCs. To the extent that the
Rubrik Customer DPA (v09252026) CONFIDENTIAL 4
Standard Contractual Clauses apply pursuant to this DPA to Personal Data transfers from the UK, the Parties agree that the UK
Addendum (Attachment I to the SCCs) found at the following URL: https://www.rubrik.com/en/legal/SCC, which amends the Standard
Contractual Clauses, will apply to all such transfers. In case of any transfers of Personal Data from Switzerland to Rubrik in a third
country, the following provisions apply: (i) general and specific references in the EU SCCs to the GDPR, or EU or Member State law, shall
have the same meaning as the equivalent reference in the Swiss Data Protection Laws; (ii) in respect of data transfers governed by Swiss
Data Protection Laws, the EU SCCs also apply to the transfer of information relating to an identified or identifiable legal entity where such
information is protected similarly as Personal Data under Swiss Data Protection Laws until such laws are amended to no longer apply to
a legal entity; (iii) where the data exporter is established in Switzerland or falls within the territorial scope of application of Swiss Data
Protection Laws, the FDPIC shall act as competent Supervisory Authority insofar as the relevant data transfer is governed by Swiss Data
Protection Laws; and (iv) for Data Subjects habitually resident in Switzerland, the courts of Switzerland are an alternative place of
jurisdiction in respect of disputes. The Data Security Schedule set forth in Section 4 of this DPA shall also serve as the applicable
technical and organizational security measures required for an international transfer of Personal Data under the SCCs. Rubrik provides
additional safeguards to Customer and additional redress to the Data Subjects to whom that Personal Data relates, as further described
in Annex IV of the SCCs (“Additional Safeguards”). To the extent a Restricted Transfer occurs from a jurisdiction outside the EEA, UK,
or Switzerland that requires or permits the use of standard contractual clauses or equivalent transfer mechanisms, the Parties agree
that the EU SCCs (as referenced above) shall apply to such transfers, with any modifications necessary to comply with the applicable
local Data Protection Laws of the originating jurisdiction.
11. ADDITIONAL PROCESSING OBLIGATIONS.
11.1 Rubrik acknowledges its obligations to (i) provide the same level of privacy protection to Personal Data as required by applicable
Data Protection Laws; and (ii) notify Customer if it cannot or can no longer meet its obligations under applicable Data Protection Laws.
11.2 Rubrik acknowledges that (i) Customer is disclosing Personal Data to Rubrik solely for a valid business purpose and to perform the
Rubrik Service as set forth in the Agreement; (ii) Rubrik does not receive any Personal Data as consideration for the Rubrik Service or
other products or services that Rubrik provides to Customer: (iii) Rubrik shall not have, derive, or exercise any rights or benefits regarding
Personal Data; (iv) Rubrik will not sell any Personal Data, as the term is defined in applicable Data Protection Laws; (v) Rubrik will not
collect, combine, retain, or use any Personal Data except as necessary to perform the Rubik Service for Customer and only within the
direct business relationship with Customer; and (vi) Rubrik will make available all information necessary to demonstrate Rubrik’s
compliance with applicable Data Protection Laws and this DPA.
12. LAW ENFORCEMENT ACCESS. Rubrik will not disclose or provide access to any Customer Data Processed by Rubrik under
this DPA to a law enforcement agency, unless required by applicable law. If a law enforcement agency contacts Rubrik with a demand
for Customer Data, Rubrik will attempt to redirect the law enforcement agency to request that data directly from Customer. If Rubrik is
compelled to disclose or provide access to any Customer Data Processed under this DPA to such law enforcement agency, Rubrik will
promptly notify Customer and provide a copy of the demand unless legally prohibited from doing so. In accordance with the Data Security
Schedule, Rubrik further acknowledges that: (i) it has not purposefully created back doors (non-transparent access capabilities) or
similar programming that could be used to enable unauthorized access of any Customer Data or systems at Customer; (ii) it has not
purposefully created or changed its business processes in a manner that facilitates unauthorized access to Customer Data or systems
at Customer; and (iii) no applicable laws require Rubrik to create or maintain any back doors or facilitate unauthorized access to
Customer Data or systems at Customer, or for Rubrik to be in possession of or hand over any third party encryption keys to decrypt
Customer Data.
13. CHANGES IN LAWS. In the event of (i) any newly enacted Data Protection Law; (ii) any change to an existing Data Protection
Law (including generally-accepted interpretations thereof); (iii) any qualified and informed interpretation of a new or existing Data
Protection Law; or (iv) any material new or emerging cybersecurity threat, which individually or collectively requires a change in the
manner by which Rubrik is delivering the Rubrik Service to Customer, the Parties shall agree upon how Rubrik’s delivery of the Rubrik
Service will be impacted and shall make equitable adjustments to the terms of the Agreement and the Rubrik Service.
Rubrik Customer DPA (v09252026) CONFIDENTIAL 5
EXHIBIT 1 TO THE DATA PROCESSING ADDENDUM
Description of Processing of Personal Data
Subject matter and duration of the Processing of Personal Data:
The subject matter of the Processing of the Personal Data is set out in the Agreement (including all applicable attachments); namely for
Rubrik to provide the Rubrik Service. The duration of the Processing of Personal Data shall be for the Term of the Agreement.
The nature and purpose of the Processing of Personal Data:
The nature and purpose of the Processing of the Personal Data are set out in the Agreement (including all applicable attachments) and
include the delivery of the functional capabilities of the Rubrik Service pursuant to the Customer Instructions and applicable Data
Protection Laws.
The categories of Data Subject to whom the Personal Data relates:
Due to the nature of backup services and the encryption of Personal Data in Customer’s environment, Rubrik may not be able to
determine the exact categories of Data Subjects associated with the Personal Data, which may vary depending on Customer’s use of
the Rubrik Service. Customer acknowledges and agrees that Customer elects the categories of Data Subjects to whom the Customer
Personal Data relates in Customer’s sole discretion. Without limiting the foregoing, Rubrik acknowledges that the Categories of Data
Subjects to whom the Personal Data relates may include Customer’s employees, contractors, customers, vendors and other affiliated
entities.
The types of Personal Data to be Processed:
Due to the nature of backup services and the encryption of Personal Data in Customer’s environment, Rubrik may not be able to
determine the exact types of Personal Data associated with the Personal Data, which may vary depending on Customer’s use of the
Rubrik Service. Customer acknowledges and agrees that Customer elects the types of Personal Data to be Processed in Customer’s
sole discretion. Without limiting the foregoing, Rubrik acknowledges that the types of Personal Data to be Processed may include (i)
general personal data (contact information, login information, family and lifestyle information); (ii) employment and HR data
(employment history, salary, performance assessments); (iii) financial details (banking details, account numbers), sensitive data
(special categories of data, including biometric data); and/or (iv) digital/internet activity (mobile device and network carrier data, IP
addresses, browsing activity).
Rubrik Customer DPA (v09252026) CONFIDENTIAL 6