How-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read
GDPR evidence
Google LLC is a global technology
No public evidenceGoogle and GDPR
CertReports found no public GDPR evidence for Google as of unknown date. This does not mean the vendor is non-compliant. It means CertReports found no public evidence at the last check.
Evidence
VerifiedActive: EU-US Certification, UK Extension Certification
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 21 Jan 2025
- Expires or valid through
- 12 Jan 2027
- Scope
- Waymo LLC and its wholly-owned U.S. subsidiaries participate in the EU-U.S. Data Privacy Framework (EU-U.S. DPF), and the UK Extension to the EU-U.S. DPF. With respect to personal data other than human resources data: Waymo processes data for purposes related to providing, operating, developing, and improving our autonomous vehicle technology and services. This includes: managing customer relationships and providing rider support; ensuring the safety and security of our services and operations; conducting research and development; marketing of our services; financial processing and management; managing supplier, vendor, and partner relationships; fraud prevention; protection of Waymo and compliance with applicable laws and regulations. Types of personal data may include rider account and profile information, trip data, video and image data captured is in public places, service usage data, website visitor data, and business contact information. Data is disclosed to third parties as detailed in the Waymo Services Privacy Policy, including to service providers acting on our behalf, business partners, with user consent, and for legal or regulatory reasons. With respect to human resources data: Waymo LLC collects personal data in the context of human resources and processes them in accordance with its Candidate and Employee Privacy Policies. Human resources data is processed for various employment and legal purposes, including: recruitment and staffing; compensation, benefit programs and payroll; performance assessment, management and training; talent management and succession planning; legal compliance and risk management; workplace management, including Waymo LLC business-related travel; protection against injury, theft, legal liability, fraud and abuse; to identify, report on and investigate violations of company policies and/or applicable laws and regulations; to administer background checks in countries where permitted; for business management and planning, including business reorganizations and job eliminations, business transfers and potential divestments; making decisions about employment and for other business-related or legal purposes. Data is disclosed to third parties as detailed in our relevant Privacy Policies, listed below, including for business-related and legal purposes.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | Waymo LLC: Active: EU-US Certification, UK Extension Certification | Live pagesha256 25cc5fe9f5 |
VerifiedActive: UK Extension Certification, EU-US Certification, SW-US Certification
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 22 Sep 2016
- Expires or valid through
- 13 Sep 2027
- Scope
- This certification applies to Google LLC and its wholly-owned U.S. subsidiaries, including any wholly-owned U.S. subsidiary of Google LLC except to the extent it maintains a current separate self-certification by such entity. With respect to personal data other than human resources data: Data is processed for various purposes depending on the particular product or service being provided, including: sales and marketing to consumers and businesses; supplying services and products to consumers and businesses; operating, developing and improving services and products of Google and/or any of its wholly-owned U.S. subsidiaries; personalizing services and products; financial processing and management; supplier, vendor and partner relationship management; fraud prevention, security, and protection of Google, its wholly-owned U.S. subsidiaries, and our users; compliance with applicable law and governmental, legislative and regulatory bodies; and customer support and relationship management. Data is disclosed to third parties as detailed in our relevant Privacy Policies, listed below, including: in situations in which we have consent, for external processing, with domain administrators, and for legal reasons. With respect to human resources data: Data is processed for various employment and legal purposes, including: recruitment and staffing; compensation, benefit programs and payroll; performance management and training; compliance and risk management; workplace management; protection against injury, theft, legal liability, fraud and abuse; and other business purposes. Data is disclosed to third parties as detailed in our relevant Privacy Policies, listed below, including for business-related and legal purposes.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | Google LLC: Active: UK Extension Certification, EU-US Certification, SW-US Certification | Live pagesha256 50922bda3e |
ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Scope
- Tim Hahn sometimes gets info from but is not authorized to disclose it to anyone. Any personal info.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | kristin Hahn: Inactive | Live pagesha256 96550bcebe |
ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Scope
- Testing Prod
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | TestingProd: Inactive | Live pagesha256 a45a494953 |
ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Scope
- We collect personal data (name, employer/job title, office phone & email) on employees at client companies with whom we interact with on a regular basis. We also collect information on individuals who have indicated to us that they may be interested in a potential business transaction with one or more of our clients. The purpose is to make our business development and client servicing processes run more efficiently by maintaining a centralized internal database of contact information.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | Solebury Trout LLC: Inactive | Live pagesha256 c08ad650a1 |
ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 4 Aug 2017
- Scope
- TLG Associates, with one employee (owner), provides virtual leadership training services to its Individual Customers. TLG Associates is provided Personal Data directly from the Customer (client) with a list of its participants (employees) for participation in a TLG Associate’s leadership virtual webinar. Delivered from the US. As a general matter, TLG Associates collects the following types of Personal Data from its Individual Customers, which is provided by the client: contact information of each participant to include only: contact person's name, title and work email. The information that is collected from Individual Customers is used for pre and post leadership training communication and only includes sending out virtual meeting details in advance of a live webinar and directly after with follow-up program materials.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | TLG Associates: Inactive | Live pagesha256 e28f078e49 |
ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Scope
- test application
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | DPF Testing Org, LLC: Inactive | Live pagesha256 38801d6353 |
ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Scope
- asd
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | Organizaiton Name: Inactive | Live pagesha256 a6b8491e84 |
ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Scope
- Required data for submission
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | Fen's Veggies - Test Branch: Inactive | Live pagesha256 f8c2ef69da |
ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Scope
- [email protected]
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | fitsum tegegn: Inactive | Live pagesha256 77a5bcba5d |
ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Scope
- for intellectual property rights
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | alexsio274limited: Inactive | Live pagesha256 7f024739f3 |
ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Scope
- Information about how we collect, use, and share data is available in our privacy policy: https://drive.google.com/open?id=1K5JKeEHx3E1dL6l5VCNl-8yNmnzObZQa
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | Crowbar Collective: Inactive | Live pagesha256 9b3879ff41 |
ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 23 Jan 2017
- Scope
- Nearpod processes personal data in order to provide interactive classroom lessons synchronized on student tablets and mobile devices. Account holders, such as teachers and educators, may provide information such as first and last name, email address, school, grade level, password, role, and profile photo. Nearpod automatically receives information from the device when using Nearpod. This includes IP address, duration of time spent, the type of device, a device identifier, the version of the Nearpod application on mobile device, device event information such as crashes, hardware settings, date and time information, and actions performed while visiting the Nearpod website.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | Nearpod Inc.: Inactive | Live pagesha256 6a83301386 |
ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Scope
- |
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | google: Inactive | Live pagesha256 1889d64c39 |
ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Scope
- Research
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | Google: Inactive | Live pagesha256 f61ca22f45 |
ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Scope
- world web page systematic programming
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | Google: Inactive | Live pagesha256 888216d85d |
ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Scope
- เพื่อเปิดเผยข้อมูลตามนโยบายความโปรงใส่ในการตรวจสอบ และ องค์กรต่างๆ 1.บริษัท Google LLC 2.บิรษัท Coal-fire Systems,lnc 3. บริษัท Emst&Young (EY) 4.บริษัท Cloudflsre DDos
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | Google Cloud Platform: Inactive | Live pagesha256 95360ee31a |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Google GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Cloud and hosting category) whose GDPR row is verified or vendor-stated, ranked by similarity.
Understand GDPR evidence
All articlesExplainers
The EU-US Data Privacy Framework, explained for vendor reviews
Solomon Amos · 7 Sep 2026 · 10 min read