What changed in QuickBooks's DPA — and what to check now

What changed

QuickBooks — operated by The Rocket Science Group LLC d/b/a Intuit QuickBooks [src:vendor/quickbooks] — has a documented history of instability around its Data Processing Agreement over recent weeks, and the current state warrants a methodical check before your next client review.

The sequence matters. In early 2025, QuickBooks added a comprehensive DPA effective January 13, 2025 [src:vendor_change/c6c1e36c-3a4f-425b-8834-bb1ec2e25a5d]. That document introduced standard contractual clauses (SCCs) and the EU-US Data Privacy Framework (DPF) as transfer mechanisms, together with Swiss-US and UK Extension variants [src:vendor_change/39c649a2-767c-4da8-8c4b-78e13ec48e9c]. It defined the roles of QuickBooks and its customers in the controller/processor relationship, and it specified security requirements and sub-processor management procedures [src:vendor_change/c6c1e36c-3a4f-425b-8834-bb1ec2e25a5d].

That document is now gone. References to SCCs and the EU-US Data Privacy Framework have been removed from the publicly accessible documentation [src:vendor_change/6fad8dd2-ec7b-41e9-8746-a88972ed4dbb]. The DPA URL at intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/ has been returning errors — at various points an HTTP 429 and later a plain server error — with no replacement document currently accessible [src:vendor_change/7f31a3e7-1466-4a52-892b-36dfdbed8614] [src:vendor_change/765c9ac3-054b-4443-96eb-3dece75de5cf]. The change is classified as critical severity [src:vendor_change/765c9ac3-054b-4443-96eb-3dece75de5cf].

One separate, non-substantive change is worth noting to avoid confusion. A recent update to the DPA page added a promotional notice about an Intuit Connect livestream event scheduled for October 26–28 [src:vendor_change/d967645b-f768-49db-a047-2e3e5f2c0d8c]. That notice does not affect the substantive terms of data processing or any compliance obligations [src:vendor_change/d967645b-f768-49db-a047-2e3e5f2c0d8c]. Disregard it; the substantive problem is the inaccessibility of the agreement itself.

The vendor data was last verified on 16 September 2026 and last updated on 20 October 2026 [src:vendor/quickbooks]. The transfer mechanism currently recorded in the vendor profile is DPF [src:vendor/quickbooks], but that record now lacks a publicly accessible document to support it.

Who it affects

The gap matters most for clients whose personal data flows from the EEA, UK, or Switzerland to QuickBooks's US infrastructure. Those jurisdictions require a documented, lawful transfer mechanism for any transfer to a third country [src:vendor_change/a8936a9c-9405-4efa-a61d-fc2cdd938b35]. Without a publicly accessible DPA, your client cannot point to the specific SCCs or DPF enrolment that covers the transfer, and cannot record it accurately in their register of processing activities.

The removal also changes what can legitimately appear in a client's subprocessor list. The January 2025 DPA had specified sub-processor management procedures [src:vendor_change/c6c1e36c-3a4f-425b-8834-bb1ec2e25a5d]. If your client's own DPA with their customers lists QuickBooks as a subprocessor relying on SCCs or DPF, that contractual representation now rests on documentation that is not publicly verifiable.

There is a compounding issue on the subprocessor list itself. WorldPay (Worldpay, LLC, a US entity) appears on the QuickBooks subprocessor list [src:vendor/worldpay]. WorldPay currently has no publicly documented DPA or transfer mechanism of its own [src:vendor/worldpay]. That is a separate gap, but one that sits directly downstream of the QuickBooks relationship. Clients in scope for transfer documentation requirements should know about it. You can review what the subprocessor list URL currently shows at quickbooks.intuit.com/uk/legal/dpa-subprocessors/ [src:vendor/quickbooks].

The controller/processor role allocation that the January 2025 DPA set out is also now undocumented [src:vendor_change/c6c1e36c-3a4f-425b-8834-bb1ec2e25a5d]. Whether QuickBooks acts as processor or independent controller for a given data set depends on the facts of the relationship; the absence of a public DPA does not resolve that question — it removes a document that previously addressed it.

For context on how similar DPA disappearances play out in practice, the situation has some parallels to what happened with Zendesk; the analysis in Zendesk removed its DPA: what to check before your next client review covers the same category of problem. The general framework for recording these changes is in Subprocessor lists: what changes when a vendor updates its DPA.

What to do about it

Attempt to access the DPA directly. The URL listed in the vendor record is the Intuit QuickBooks data processing terms page [src:vendor/quickbooks]. A 429 error indicates rate-limiting rather than deletion; a 5xx error suggests a server fault. Document what you see and when. If the document has returned by the time you check, screenshot and date it. If it remains inaccessible, proceed as if there is no public DPA.

Check whether a DPA was executed directly. Some QuickBooks customers will have signed a DPA as part of an enterprise or reseller agreement. If your client has a countersigned agreement in their contract records, that document may independently satisfy the transfer mechanism requirement even if the public URL is down. Ask your client's procurement or legal team before assuming the public version is the only version.

Flag the transfer mechanism gap in client records. The current vendor profile records DPF as the transfer mechanism [src:vendor/quickbooks], but a transfer mechanism that cannot be verified from a public document cannot be confidently cited in a record of processing activities or a client-facing DPA. Note the uncertainty, the date you checked, and what you found. For guidance on how to structure that record, see GDPR breach register: a template and what goes in it for the general recording logic, and Subprocessor lists: what changes when a vendor updates its DPA for the subprocessor-specific steps.

Review any downstream commitments your client has made. If your client's own DPA with their customers names QuickBooks as a subprocessor and specifies SCCs or DPF as the transfer basis, that representation needs to be reviewed. The brand-versus-counterparty question is also live here: the legal entity is The Rocket Science Group LLC d/b/a Intuit QuickBooks [src:vendor/quickbooks], and any executed agreement needs to name the correct counterparty. The analysis in The brand is not the counterparty is directly relevant. A vendor entity change compounds exactly these problems; see A vendor changed its entity: which documents are now wrong for the checklist.

Note the WorldPay subprocessor gap separately. Because WorldPay has no publicly documented DPA or transfer mechanism [src:vendor/worldpay], clients who need to document the full chain of subprocessing — controller → QuickBooks → WorldPay — have a gap at both links at present. That may or may not be material depending on what data flows through WorldPay in a given client's use case, but it belongs in the file.

Set a review date. The pattern here — document present, document absent, document present, document absent — suggests the instability may resolve. Check again in a short cycle. When the DPA returns, verify that it still contains SCCs, DPF, the Swiss-US variant, and the UK Extension that the January 2025 version carried [src:vendor_change/39c649a2-767c-4da8-8c4b-78e13ec48e9c], and confirm the effective date has not changed.

If you manage QuickBooks across multiple clients, the general scaling considerations in How to scale a privacy practice past 20 clients cover how to handle vendor-level changes that affect a portfolio rather than a single engagement [src:vendor/quickbooks].