Vendor registry · CRM and marketing
Salesforce: DPA, subprocessors and transfers
Last checked 16 September 2026. Changes to this record are tracked.
- Contracting legal entity
- SFDC Ireland Limited
- Country of registration
- Ireland
- Transfer mechanism
- EU-US Data Privacy Framework (DPF)
A US certification scheme covered by an EU adequacy decision. Transfers to a certified US organisation need no further mechanism for the certified scope.
- Data processing agreement
- https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Agreements/data-processing-addendum.pdf
- Subprocessor list
- https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-infrastructure-and-subprocessors.pdf
- Security or trust page
- https://www.salesforce.com/company/legal/trust-and-compliance-documentation/
What to put in your subprocessor list
A ready row. Replace the purpose with what your client actually uses Salesforce for.
| Subprocessor | Legal entity | Country | Purpose | Transfer | DPA |
|---|---|---|---|---|---|
| Salesforce | SFDC Ireland Limited | IE | CRM and marketing | DPF | https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Agreements/data-processing-addendum.pdf |