QuickBooks: DPA, subprocessors and transfers

Links last opened 29 October 2026. Record confirmed by a person on 16 September 2026. 13 recorded changes, listed below.

QuickBooks contracts through The Rocket Science Group LLC d/b/a Intuit QuickBooks, registered in United States. Transfers of personal data out of the EEA are covered by EU-US Data Privacy Framework (DPF). Its trust center is published at https://security.intuit.com/. Its customer data processing agreement, also called a data processing addendum, is published by QuickBooks itself; the link is below. Its sub-processor list is published by QuickBooks itself; the link is below. We open those pages every day — last on 29 October 2026 — and a person last went through this record on 16 September 2026.

Contracting legal entity: The Rocket Science Group LLC d/b/a Intuit QuickBooks
Country of registration: United States
Transfer mechanism: EU-US Data Privacy Framework (DPF)
A US certification scheme covered by an EU adequacy decision. Transfers to a certified US organisation need no further mechanism for the certified scope.
Data processing agreement: https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/
Subprocessor list: https://quickbooks.intuit.com/uk/legal/dpa-subprocessors/
Security or trust page: https://security.intuit.com/

What to put in your subprocessor list

A ready row. Replace the purpose with what your client actually uses QuickBooks for.

Subprocessor	Legal entity	Country	Purpose	Transfer	DPA
QuickBooks	The Rocket Science Group LLC d/b/a Intuit QuickBooks	US	Finance	DPF	https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/

Questions people ask about QuickBooks

Where is QuickBooks's DPA?: QuickBooks publishes its customer data processing agreement at https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/. We last opened that link on 29 October 2026.
Is QuickBooks's DPA the same thing as a data processing addendum?: Yes. A data processing agreement and a data processing addendum are two names for the document Article 28 of the GDPR requires between a controller and a processor; vendors use both, and some call it processor terms. What it has to contain does not change with the name. QuickBooks's is at https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/.
Where is QuickBooks's sub-processor list?: QuickBooks publishes the list of its own sub-processors at https://quickbooks.intuit.com/uk/legal/dpa-subprocessors/. We last opened that link on 29 October 2026.
Which legal entity does QuickBooks contract through?: The Rocket Science Group LLC d/b/a Intuit QuickBooks, registered in United States. That is the name to put in a record of processing or a sub-processor list, not the brand.
What covers a transfer of personal data to QuickBooks outside the EEA?: EU-US Data Privacy Framework (DPF). A US certification scheme covered by an EU adequacy decision. Transfers to a certified US organisation need no further mechanism for the certified scope. Whether that is enough for a particular processing operation is a judgement for the controller.
Where is QuickBooks's trust center?: QuickBooks publishes it at https://security.intuit.com/. A trust center, trust page or security page is the same thing under different names: the vendor's own account of how it protects data, and the place it keeps its certifications. It is QuickBooks's page, so we link to it rather than repeat what it says.

What has changed, and when

Changes we noticed on QuickBooks's own pages, each with the page we saw it on. The vendor does not publish this, and neither does anyone else.

29 October 2026
One line about a livestream event was removed from the DPA. This does not affect data processing obligations or subprocessor disclosures.
Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/
22 October 2026
QuickBooks updated its Data Processing Agreement effective January 13, 2025 to specify that it relies on standard contractual clauses (2021 Controller-to-Processor and Processor-to-Processor versions) and the EU-US Data Privacy Framework, Swiss-US Data Privacy Framework, and UK Extension for international data transfers. The agreement now includes detailed definitions of sub-processors, security obligations, and Intuit's dual role as both processor and controller for specific limited purposes, which may require updates to records of processing and subprocessor lists.
Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/
21 October 2026
The vendor's Data Processing Agreement documentation is no longer accessible, as indicated by HTTP 429 errors, meaning the transfer mechanisms previously listed—standard contractual clauses and the EU-US Data Privacy Framework—cannot be verified or referenced for compliance purposes. This requires updating any subprocessor list or record of processing to reflect that the current data transfer legal basis documentation is unavailable.
Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/
20 October 2026
The Data Processing Agreement now includes a promotional notice about an Intuit Connect livestream event scheduled for October 26-28, which does not affect the substantive terms of data processing or your compliance obligations.
Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/
18 October 2026
QuickBooks added a comprehensive Data Processing Agreement effective January 13, 2025, introducing standard contractual clauses (SCCs) and the EU-US Data Privacy Framework as transfer mechanisms for personal data to replace their previous transfer approach. This change establishes formal data protection obligations for processors, defines roles between QuickBooks and customers, and specifies security requirements and sub-processor management procedures that must be reflected in records of processing and subprocessor lists.
Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/
17 October 2026
QuickBooks removed its Data Processing Agreement that specified standard contractual clauses and the EU-US Data Privacy Framework as transfer mechanisms, with no replacement document currently accessible. This eliminates the documented legal basis for international data transfers and changes how the vendor's data processing obligations should be recorded in subprocessor lists and processing records.
Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/
15 October 2026
QuickBooks updated its data processing agreement to include standard contractual clauses and the EU-US Data Privacy Framework as transfer mechanisms, effective January 13, 2025. This matters because it specifies the legal frameworks now governing international data transfers for customers in the EEA, UK, and Switzerland.
Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/
14 October 2026
QuickBooks removed their Data Processing Agreement that specified standard contractual clauses and the EU-US Data Privacy Framework as transfer mechanisms, and the document is no longer accessible due to a server error. This means the documented legal basis for international data transfers and processor obligations is currently unavailable.
Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/
12 October 2026
QuickBooks updated its data transfer mechanisms to reference standard contractual clauses and the EU-US Data Privacy Framework, effective January 13, 2025. This matters because it specifies the legal mechanisms QuickBooks uses to transfer personal data internationally, which must be documented in your records of processing and data processing agreements.
Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/
11 October 2026
The vendor has removed references to standard contractual clauses and the EU-US Data Privacy Framework from their Data Processing Agreement, replacing the previous legal transfer mechanisms documentation with HTTP error pages, which means the documented legal basis for international data transfers is no longer publicly available.
Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/
8 October 2026
QuickBooks added a comprehensive Data Processing Agreement effective January 13, 2025, that now specifies transfer mechanisms including standard contractual clauses and the EU-US Data Privacy Framework (along with Swiss-US and UK Extension variants) for international data transfers. This establishes the legal basis for transferring personal data outside the EEA and affects how customer data flows should be documented in records of processing and subprocessor management.
Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/
5 October 2026
QuickBooks removed its Data Processing Agreement that specified standard contractual clauses and EU-US Data Privacy Framework as transfer mechanisms, and the vendor's documentation is now inaccessible due to an HTTP 429 error. This means the documented legal basis and procedures for international data transfers for QuickBooks Online customers are no longer available to review.
Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/
2 October 2026
We recorded changes to the data processing agreement link, the sub-processor list link.

Building your own sub-processor list?

Enter your website: each service it loads, what it is for and links to its own DPA, in a minute or two. No sign-up.

Build my list

Worked out from the registry and what we have written: the country this vendor contracts from, the guides that answer the question this page raises, and the rest of the registry.

Other finance

Six of them. All finance in the registry · others that transfer the same way.

Subprocessor

Legal entity

Country

Purpose

Transfer

DPA

QuickBooks

The Rocket Science Group LLC d/b/a Intuit QuickBooks

Finance

DPF

https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/

Questions people ask about QuickBooks

Where is QuickBooks's DPA?

QuickBooks publishes its customer data processing agreement at https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/. We last opened that link on 29 October 2026.

Is QuickBooks's DPA the same thing as a data processing addendum?

Yes. A data processing agreement and a data processing addendum are two names for the document Article 28 of the GDPR requires between a controller and a processor; vendors use both, and some call it processor terms. What it has to contain does not change with the name. QuickBooks's is at https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/.

Where is QuickBooks's sub-processor list?

QuickBooks publishes the list of its own sub-processors at https://quickbooks.intuit.com/uk/legal/dpa-subprocessors/. We last opened that link on 29 October 2026.

Which legal entity does QuickBooks contract through?

The Rocket Science Group LLC d/b/a Intuit QuickBooks, registered in United States. That is the name to put in a record of processing or a sub-processor list, not the brand.

What covers a transfer of personal data to QuickBooks outside the EEA?

EU-US Data Privacy Framework (DPF). A US certification scheme covered by an EU adequacy decision. Transfers to a certified US organisation need no further mechanism for the certified scope. Whether that is enough for a particular processing operation is a judgement for the controller.

Where is QuickBooks's trust center?

QuickBooks publishes it at https://security.intuit.com/. A trust center, trust page or security page is the same thing under different names: the vendor's own account of how it protects data, and the place it keeps its certifications. It is QuickBooks's page, so we link to it rather than repeat what it says.

What has changed, and when

Changes we noticed on QuickBooks's own pages, each with the page we saw it on. The vendor does not publish this, and neither does anyone else.

29 October 2026

One line about a livestream event was removed from the DPA. This does not affect data processing obligations or subprocessor disclosures.

Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/

22 October 2026

QuickBooks updated its Data Processing Agreement effective January 13, 2025 to specify that it relies on standard contractual clauses (2021 Controller-to-Processor and Processor-to-Processor versions) and the EU-US Data Privacy Framework, Swiss-US Data Privacy Framework, and UK Extension for international data transfers. The agreement now includes detailed definitions of sub-processors, security obligations, and Intuit's dual role as both processor and controller for specific limited purposes, which may require updates to records of processing and subprocessor lists.

Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/

21 October 2026

The vendor's Data Processing Agreement documentation is no longer accessible, as indicated by HTTP 429 errors, meaning the transfer mechanisms previously listed—standard contractual clauses and the EU-US Data Privacy Framework—cannot be verified or referenced for compliance purposes. This requires updating any subprocessor list or record of processing to reflect that the current data transfer legal basis documentation is unavailable.

Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/

20 October 2026

The Data Processing Agreement now includes a promotional notice about an Intuit Connect livestream event scheduled for October 26-28, which does not affect the substantive terms of data processing or your compliance obligations.

Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/

18 October 2026

QuickBooks added a comprehensive Data Processing Agreement effective January 13, 2025, introducing standard contractual clauses (SCCs) and the EU-US Data Privacy Framework as transfer mechanisms for personal data to replace their previous transfer approach. This change establishes formal data protection obligations for processors, defines roles between QuickBooks and customers, and specifies security requirements and sub-processor management procedures that must be reflected in records of processing and subprocessor lists.

Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/

17 October 2026

QuickBooks removed its Data Processing Agreement that specified standard contractual clauses and the EU-US Data Privacy Framework as transfer mechanisms, with no replacement document currently accessible. This eliminates the documented legal basis for international data transfers and changes how the vendor's data processing obligations should be recorded in subprocessor lists and processing records.

Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/

15 October 2026

QuickBooks updated its data processing agreement to include standard contractual clauses and the EU-US Data Privacy Framework as transfer mechanisms, effective January 13, 2025. This matters because it specifies the legal frameworks now governing international data transfers for customers in the EEA, UK, and Switzerland.

Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/

14 October 2026

QuickBooks removed their Data Processing Agreement that specified standard contractual clauses and the EU-US Data Privacy Framework as transfer mechanisms, and the document is no longer accessible due to a server error. This means the documented legal basis for international data transfers and processor obligations is currently unavailable.

Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/

12 October 2026

QuickBooks updated its data transfer mechanisms to reference standard contractual clauses and the EU-US Data Privacy Framework, effective January 13, 2025. This matters because it specifies the legal mechanisms QuickBooks uses to transfer personal data internationally, which must be documented in your records of processing and data processing agreements.

Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/

11 October 2026

The vendor has removed references to standard contractual clauses and the EU-US Data Privacy Framework from their Data Processing Agreement, replacing the previous legal transfer mechanisms documentation with HTTP error pages, which means the documented legal basis for international data transfers is no longer publicly available.

Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/

8 October 2026

QuickBooks added a comprehensive Data Processing Agreement effective January 13, 2025, that now specifies transfer mechanisms including standard contractual clauses and the EU-US Data Privacy Framework (along with Swiss-US and UK Extension variants) for international data transfers. This establishes the legal basis for transferring personal data outside the EEA and affects how customer data flows should be documented in records of processing and subprocessor management.

Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/

5 October 2026

QuickBooks removed its Data Processing Agreement that specified standard contractual clauses and EU-US Data Privacy Framework as transfer mechanisms, and the vendor's documentation is now inaccessible due to an HTTP 429 error. This means the documented legal basis and procedures for international data transfers for QuickBooks Online customers are no longer available to review.

Seen on https://www.intuit.com/legal/terms/en-us/quickbooks/qbo-data-processing/

2 October 2026

We recorded changes to the data processing agreement link, the sub-processor list link.

QuickBooks: DPA, subprocessors and transfers

What to put in your subprocessor list

Questions people ask about QuickBooks

What has changed, and when

Building your own sub-processor list?

Where to go next

Other finance

QuickBooks: DPA, subprocessors and transfers

What to put in your subprocessor list

Questions people ask about QuickBooks

What has changed, and when

Building your own sub-processor list?

Where to go next

Other finance