Data protection and privacy

As a business-to-business enterprise application provider, SAP receives few requests from government agencies or similar parties (“Requesting Party”) requiring SAP to produce or disclose information that contains or includes any customer data (“Request”). In all cases where SAP receives Requests, SAP will advise the Requesting Party that all customer data stored in any SAP customer cloud system belongs to the customer, not to SAP, and that such data is confidential, and that SAP cannot and will not produce or disclose any such information to the Requesting Party without first complying with its contractual obligation to provide notice to the customer about the Request to give the customer an opportunity to consent or to object and seek an appropriate protective order.

If the Requesting Party prohibits SAP from providing such notice to the customer, then SAP will try to challenge the Request if it is invalid or unlawful. If the competent court issues a ruling that compels SAP to comply with a Request without prior notice to the customer, SAP will challenge such ruling to the extent recourse is available and SAP has a good faith basis under existing applicable law to challenge the ruling. If no such recourse exists, or if SAP’s attempt to challenge the ruling on appeal is not successful, SAP will make all reasonable efforts to narrow the scope of the Request to the extent permitted under applicable laws before complying with it.