Dropbox
GDPR evidence
Backup and share files in the cloud.
No public evidenceDropbox and GDPR
CertReports found no public GDPR evidence for Dropbox as of unknown date. This does not mean the vendor is non-compliant. It means CertReports found no public evidence at the last check.
Evidence
VerifiedActive: EU-US Certification, SW-US Certification, UK Extension Certification
as of 17 Sep 2026 · confidence 100%- Kind
- listing
- Issued or listed
- 23 Sep 2016
- Expires or valid through
- 7 May 2027
- Scope
- Dropbox provides a website, software, and mobile applications which allow people to store and synchronize files across multiple devices, and collaborate with others. Dropbox offers services to individuals on both a free and paid subscription basis (e.g. Dropbox Basic, Plus, etc) and services intended for use within teams and organizations on a paid subscription basis (e.g. Dash for Teams, Dropbox Standard, Advanced, Enterprise, etc.) Many of these plans are inclusive of additional add-ons (e.g. Paper, Transfer, etc). Certain Dropbox services may also be accessed by APIs, which taken together, are elements of the Dropbox Developer Platform. Dropbox, through Dropbox Sign Services, provides a website, software, and mobile applications which allow people to streamline complex transactions through innovative digital solutions such as electronic fax, electronic signature, and workflow automation. Dropbox Sign offers services to individual users on both a free and paid subscription basis (e.g. Sign Free, Sign Essentials, Fax Free, Sign API Essentials, etc). These plans are inclusive of the Dropbox Sign, Sign API, and Fax products. Dropbox, through Dropbox DocSend Services, provides a website and software which offer a suite of functionality built around common workflows for managing and sharing documents externally, including content management, engagement analytics, and security features. DocSend offers services to individual users on a paid subscription basis (Personal). DocSend also offers services intended for use within teams and organizations on a paid subscription basis (e.g. Standard, Advanced Data Rooms, etc). The Reclaim service provides a website and software designed to help users align their calendars to priorities, automatically synchronize personal and work calendars, automate time blocking, as well as augment calendar appearance to make it easier to visualize time spent. The Service also gathers and aggregates data from user calendars about how time is spent to provide personalized analytics. Reclaim offers services to individual users on a free basis (Lite) and services intended for use within teams and organizations on a paid subscription basis (Starter, etc). Dropbox collects personal data from individuals in the EU, EEA, UK, and Switzerland for the purposes of providing and improving these services, entering into contracts, providing customer support, as well as enforcing its Terms of Service and Business Agreement. Dropbox uses trusted third parties (for example, providers of customer support) to help provide, improve, protect, and promote its Services. The trusted third parties may access user information to perform tasks on behalf of Dropbox. Dropbox remains responsible for the handling of user information per our instruction. Dropbox may disclose your information to additional third parties if we determine that such disclosure is reasonably necessary to: (a) comply with any applicable law, regulation, legal process, or appropriate government request; (b) protect any person from death or serious bodily injury; (c) prevent fraud or abuse of Dropbox or our users; (d) protect Dropbox’s rights, property, safety, or interest; or (e) perform a task carried out in the public interest. Dropbox processes human resources information for a variety of purposes, including, but not limited to: administration of compensation, employment relationship management, compliance with applicable laws and employment-related requirements, providing IT systems and support, benefits, performance management, responding to requests and legal demands from regulators, and compliance with corporate financial responsibilities. Dropbox discloses human resources information to third-party service providers and, when necessary, to regulators and government authorities. Dropbox, Inc. adheres to the Data Privacy Framework Principles with respect to Dropbox (including Dash), Dropbox Sign, Dropbox DocSend, and Reclaim.ai services.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 17 Sep 2026 | Dropbox, Inc.: Active: EU-US Certification, SW-US Certification, UK Extension Certification | Live pagesha256 84aab5b998 |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Dropbox GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Cloud storage category) whose GDPR row is verified or vendor-stated, ranked by similarity.
