How Splunk Uses Data
Training and Internal Policies
It’s not enough to build secure products. Every person at an organization is responsible for making sure data is secure. We train employees on policies and procedures for secure data handling, and use physical and procedural safeguards to help keep our facilities and equipment secure.
Splunk employs a full-time DPO who is responsible for overseeing the processing of data at Splunk.
The California Consumer Privacy Act (CCPA) is a California state law that expands the privacy rights of California residents and creates new compliance requirements for businesses that collect and process Personal Information of California residents. The California Privacy Rights Act (CPRA), which updates and amends the CCPA, will go into effect on January 1, 2023.
The CCPA gives California residents new rights with respect to the collection and processing of their Personal Information (broadly defined to include information that, directly or indirectly, may lead to the identification of an individual or household). These new rights include:
It also places requirements on businesses that collect and process Personal Information, such as:
The CCPA applies to businesses that collect or process the Personal Information of California residents and meet any one of the following criteria:
As Splunk processes the Personal Information of California residents and has gross annual revenues in excess of $25 million, the CCPA applies to Splunk.
Customers that use Splunk Cloud services to process Personal Information are “Businesses” under the CCPA. They are responsible for ensuring the lawful collection and processing of the Personal Information they send to Splunk Cloud.
Splunk is a “Service Provider” for the Personal Information its customers send to Splunk Cloud, and under the CCPA, is responsible for upholding its contractual commitment to only use the Personal Information it receives from customers for the purpose of performing the Splunk Cloud services.
Splunk is currently analyzing the impact of the CPRA on its data protection programs in anticipation of the January 1, 2023 effective date.
Canada's federal data protection law is the Personal Information Protection and Electronic Documents Act (PIPEDA). PIPEDA is enforced by the Office of the Privacy Commissioner of Canada (OPC). The OPC has the obligation to investigate privacy-related complaints and also has the authority to open investigations independently. While various provincial laws may also apply, they tend to be substantially similar, and therefore, Cloud Service Providers in Canada typically aim to achieve compliance with PIPEDA.
PIPEDA takes a principles-based approach to data protection requiring that organizations establish appropriate and reasonable measures to protect personal information.
Yes. PIPEDA applies to the handling of personal information, which is broadly defined as information about an identifiable individual. Canadian customers may ingest data into the Splunk Cloud Platform which meets this broad definition of personal information.
Under PIPEDA, Splunk is required to take appropriate technical, physical and organizational measures to secure personal information.
No. The Office of the Superintendent of Financial Institutions (OSFI) regulates banks and other financial institutions. Under OSFI Guideline B-10: Outsourcing Business Activities, Functions and Processes (“OSFI Guidelines”), only vendors that provide “material outsourcing” activities critical to the delivery of financial services are in scope. Given the nature of Splunk’s products and services, it is unlikely they apply to Splunk.
The General Data Protection Regulation (GDPR) is a European data protection law that became enforceable on May 25, 2018. It applies to European Union (EU) companies, as well as non-EU companies that have employees in the EU or that offer goods or services to individuals (“data subjects”) in the EU.
The GDPR grants data subjects rights of control over the privacy of their personal data, meaning “any information relating to an identified or identifiable natural person.” Under the GDPR, companies are required to be transparent about what types of personal data they collect and how they use it, be responsible for secure data processing practices, and provide notification to customers or data subjects when breaches occur. Splunk is committed to protecting customer personal data, whether our customer is based in the EU or elsewhere around the globe.
GDPR Article 4 defines “Personal Data” to be “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”
GDPR Articles 12 to 22 provide data subjects certain rights in their personal data, including the right to: (a) be informed about its collection and use; (b) access and correct their data; (c) request their data be erased (“right to be forgotten”); (d) restrict the processing of their data; (e) port their data from one company to another; (f) object to how their data is being processed; and (g) object to any automated data profiling in certain cases (for example, hiring decisions made only on the basis of an automated resume scans).
Splunk employs technical and organizational measures to protect customer data and has certified its Splunk Cloud service to industry leading security standards, such as SOC2 Type II and ISO 27001. Splunk also offers heightened security standards for those customers who require Splunk Cloud’s HIPAA (Health Insurance Portability and Accountability Act) or PCI (Payment Card Industry) environments. For more on this topic, see Splunk’s compliance certifications, standards and regulations.
A DPA is a contract between a data controller and processor that spells out what privacy and security protections will be used during processing of data, as well as what rules the processor will follow when processing the data. Splunk’s DPA and instructions for completion may be found here.
Splunk’s DPA meets the GDPR requirements that pertain to the services we provide, has been benchmarked against industry standards, and reflects our data privacy and security compliance programs. It sets forth what we do and how we do it. As such, we do not negotiate the provisions of Splunk’s DPA.
Splunk’s DPA is tailored specifically to the services we provide and the protections we offer. Processing customer data is a high-volume activity that must be streamlined for business efficiency. Implementing exceptions, such as using a customer’s DPA, will lead to operational inconsistencies that do not reflect the services we provide and the protections we offer.
Splunk maintains a list of its sub-processors that process Personal Data and updates this list as needed. Splunk customers can subscribe to notifications of new sub-processors for the services we provide. To subscribe to Splunk’s sub-processor notification listserv, click here.
No, to the contrary, the GDPR expressly allows it. Splunk relies on standard contractual clauses, an approved transfer method, to transfer personal data from the EU to the U.S. for processing.
Splunk is certified to the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks for the transfer of human resources and customer data to the United States, and while those Frameworks were recently invalidated by the European Court of Justice in its decision of July 16, 2020, and the Federal Data Protection and Information Commissioner (FDPIC) of Switzerland in its position paper of September 8, 2020, we remain committed to their underlying data protection principles.
We are monitoring events relating to these Frameworks and continue to rely on alternative transfer mechanisms for the transfer of data to the U.S., including the Standard Contractual Clauses. For more about cross-border data transfers to the Splunk Cloud Service, review: A Risk Assessment of EU Cross-Border Data Transfers to the Splunk Cloud Service.
Australia’s federal data protection law is The Privacy Act 1988 (PA), accompanied by the Australian Privacy Principles (APP), which are enumerated in the PA. While various state/territorial laws may also apply, Splunk (like other Cloud Service Providers) aims to achieve compliance with the PA.
The PA aims to implement Australia’s international obligations under the International Covenant on Civil and Political Rights and other international documents that recognize privacy as a human right. Splunk’s approach to privacy compliance applies equally to the PA’s objectives to protect the privacy of individuals, ensure responsible and transparent handling of personal information, and provide avenues for individuals to seek redress for interference with their privacy rights.
Yes. The APPs apply to private organizations that collect, use and disclose personal information* in Australia, including foreign companies that collect or hold personal information in Australia and are “carrying on a business in Australia”. Foreign companies that market to Australians and/or conduct repeated transactions with Australian customers are likely to be considered to be “carrying on a business in Australia”.
*“Personal information” is information or an opinion about an identified individual, or an individual who is reasonably identifiable: whether the information or opinion is true or not; and whether the information or opinion is recorded in a material form or not.
Under the PA, Splunk is required to only process personal information in order to perform its obligations as set forth in any agreements or as otherwise required by law.
Financial services and banking institutions are governed by the Australian Prudential Regulation Authority (APRA) which applies Prudential Standards (PS). APRA-regulated institutions must implement a basic information security framework, and ensure that its service providers’ who manage “information assets” are compliant with its framework. The key standards are: PS CPS 231-Outsourcing and PS CPS 234-Information Security. Splunk customers subject to APRA may require that Splunk meet these additional standards.
Japan’s main privacy law is the Act for the Protection of Personal Information (APPI).
The APPI regulates privacy protection issues in Japan and the Personal Information Protection Commission (PPC), a central agency, acts as the supervisory authority for privacy protection.
Yes. The APPI, like GDPR, assigns responsibility for processing personal information* based on role. Where the APPI applies to a Customer and the Customer entrusts the handling of Personal Information to a vendor like Splunk (Entrusted Persons**), Splunk is required to help ensure its secure processing.
*Personal Information is information relating to a specific, living individual, containing any description making the individual identifiable, or an individual identification code. Collecting it does not require prior consent, if not obtained via unlawful means.
**Entrusted Persons are similar to a “Data Processor” under GDPR, i.e., vendors like Splunk.
Under the APPI, Splunk is required to: (i) use the Personal Information received from Customers only for the purposes of fulfilling its contractual obligations; (ii) keep it confidential; and (iii) use reasonable efforts to prevent unauthorised disclosure to third parties, except as required to provide the service, as permitted under the APPI, or subject to the Customer’s prior written consent.
Companies in the financial services industry may also be subject to guidelines issued by the Personal Information Protection Commission (PPC). In addition, Splunk employs technical, organizational, and administrative measures to protect customer data and has certified its Splunk Cloud service to industry leading security standards, such as SOC2 Type II and ISO 27001. For additional information about how customers can secure their instance of Splunk Cloud, see Securing Splunk Cloud Platform.
The Splunk Customer Trust Portal provides you with easy, on-demand access to documentation about Splunk’s global privacy, security, and compliance programs, including certifications, compliance reports, standard security questionnaires and white papers.