Trust in Privacy

DPAs enable SAS and its customers to comply with applicable data protection laws when SAS processes personal data on behalf of you as a customer.

SAS has best-practice TOMs that protect the data we process, on behalf of our customers, against unauthorized access, alteration or deletion.

When SAS uses sub-processors (subcontractors to provide services who must access your data), we ensure that these sub-processors act in full compliance with our privacy commitment we give to you. SAS carefully evaluates the security, privacy, and confidentiality practices of a sub-processor prior to engagement. All SAS sub-processors enter into a contract with SAS that includes data privacy and security terms reflecting our privacy commitments we give to you. SAS also provides lists of our deployed sub-processors for each individual service. These lists include details on the location and country of each sub-processor per service.

At SAS, we know that your data is your business asset. It is of utmost importance for us to foster a relationship with you as a customer and partner based on trust and transparency -- in particular when we process your data. We are committed to enabling you to use our services in compliance with global data protection laws, including the European Union´s data protection regulations, rulings, and recommendations.

SAS understands that our customers are required to comply with the Schrems II judgment of the Court of Justice of the European Union (CJEU) and the subsequent final recommendations released by the European Data Protection Board (EDPB). We’ve taken necessary steps and implemented appropriate supplemental measures that enable our customers to use our services which, in some cases, involve transfers (remote access) from the United States.

This site provides further information on the latest changes due to the Schrems II ruling, additional measures we have implemented, and answers to frequently asked questions from our customers. SAS has also updated our privacy practices and DPA to implement new standards and contractual clauses (SCCs) as published by the European Commission following the Schrems II decision.

Defending your Data: SAS defends your data through clearly defined response policies and processes, strong contractual commitments, and if necessary, the courts. SAS believes all government requests for your data should be directed to you. SAS does not provide any government with direct or unfettered access to customer data.

Government and Law enforcement requests: Twice a year we will publish the number of legal demands for customer data that we receive from government and law enforcement agencies around the world. As of September 2022, we have not received any such requests.