Vendor-statedOkta and GDPR
Okta states it holds a data processing agreement. CertReports captured this on 17 Sep 2026 from its trust centre (Drata); it is a vendor statement, not an independent confirmation.
Evidence
Vendor-statedVendor states GDPR on its trust centre
as of 17 Sep 2026 · confidence 90%ExpiredInactive
as of 17 Sep 2026 · confidence 100%- Kind
- listing
- Scope
- Auth0 is a universal identity platform. Auth0 provides online services for its customers to manage the identity of their users and to help prevent cybersecurity threats. In support of providing its services and based on its customers’ instructions, Auth0 processes personal data that customers have submitted to the Auth0 services. Auth0 customers decide which personal data to submit to the services, which typically includes name, email address, address, phone number, password, as well as other information the Auth0 customer chooses to configure as part of their users’ profiles. Auth0 uses a number of third-party service providers to assist it in providing the services to customers, such as for customer support, database monitoring, data storage, data transmission, and other technical operations. These third parties may access, process, or store personal data as part of provision of their services and Auth0 maintains contracts with these third parties to limit the access, use, and disclosure of personal data in compliance with Auth0’s obligations under the Data Privacy Framework. Auth0 also may disclose personal data to its other corporate entities, to government entities, and subject to its agreements with customers.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 17 Sep 2026 | Auth0, Inc.: Inactive | Live pagesha256 1e35f0b0ec |
ExpiredInactive
as of 17 Sep 2026 · confidence 100%- Kind
- listing
- Scope
- Auth0 is a universal identity platform. Auth0 provides online services for its customers to manage the identity of their users and to help prevent cybersecurity threats. In support of providing its services and based on its customers’ instructions, Auth0 processes personal data that customers have submitted to the Auth0 services. Auth0 customers decide which personal data to submit to the services, which typically includes name, email address, address, phone number, password, as well as other information the Auth0 customer chooses to configure as part of their users’ profiles. Auth0 uses a number of third-party service providers to assist it in providing the services to customers, such as for customer support, database monitoring, data storage, data transmission, and other technical operations. These third parties may access, process, or store personal data as part of provision of their services and Auth0 maintains contracts with these third parties to limit the access, use, and disclosure of personal data in compliance with Auth0’s obligations under the Data Privacy Framework. Auth0 also may disclose personal data to its other corporate entities, to government entities, and subject to its agreements with customers.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 17 Sep 2026 | Auth0, LLC: Inactive | Live pagesha256 4850fb6c85 |
ExpiredInactive
as of 17 Sep 2026 · confidence 100%- Kind
- listing
- Issued or listed
- 23 Sep 2025
- Scope
- Okta is a comprehensive, cloud-based Identity and Access Management (IAM) platform that provides a suite of products focusing on Workforce Identity and Customer Identity and Access Management (CIAM). Okta's products enable its customers to manage and secure access for employees, partners, and customers across applications and resources while protecting against cybersecurity threats. In support of providing its services and based on its customers’ instructions, Okta processes personal data that customers have submitted to the Okta services. Okta customers decide which personal data to submit to the services, which typically includes name, email address, address, phone number, password, as well as other information the Okta customer chooses to configure as part of their users’ profiles. Okta uses a number of third-party service providers to assist it in providing the services to customers, such as for customer support, database monitoring, data storage, data transmission, and other technical operations. These third parties may access, process, or store personal data as part of provision of their services and Okta maintains contracts with these third parties to limit the access, use, and disclosure of personal data in compliance with Okta’s obligations under the Data Privacy Framework. Okta also may disclose personal data to its other corporate entities, to government entities, and subject to its agreements with customers.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 17 Sep 2026 | Okta: Inactive | Live pagesha256 cadc5d2459 |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Okta GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 17 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Identity and access category) whose GDPR row is verified or vendor-stated, ranked by similarity.
No Identity and access vendor has GDPR evidence in the index yet.