Get CPRA-ready with Box

Box now offers a US-specific Data Processing Agreement (US DPA), which includes a specific set of privacy provisions relevant to California’s amended privacy law. The US DPA includes information relating to Box’s processing of customer personal information, the security controls we’ve implemented, and how we handle consumer rights requests.

We’ve updated our privacy notice to further explain how we collect, use, and share personal information. Specifically, we’ve updated the California section of our Regional Information Notice to include an updated list of the categories of personal information Box may have collected, along with how consumers in California may exercise their privacy rights.

We approach security with a unique perspective, matching our seamless end user experience with frictionless security, enhanced visibility, and meticulous control. We make the security of our customers’ data our number-one priority, and we reflect that goal at every point in our solution. Our commitment to protecting the privacy and security of our corporate and customer data has resulted in Box leading the pack in security and privacy compliance certifications. 

We require all service providers and contractors to go through rigorous review and due diligence. Our third party risk management team assesses each provider and contractor for adherence with security, privacy, and compliance regulations and industry standards. Our written agreements enforce compliance with applicable data protection laws, including CPRA and GDPR, security controls, confidentiality, and international data-transfer requirements.

We are proud to announce that Box has obtained a new privacy certification, ISO 27701. With our impressive array of privacy, security, and compliance certifications, customers can rest easy knowing that Box meets the international standard for privacy information management. To review Box’s ISO27701 certification, visit the Trust Center.

As more California consumers exercise their rights to access or delete their personal information, organizations need to develop efficient ways to handle data subject requests. Box Relay can help you more efficiently handle requests by setting up automatic workflows for verifying, responding, reviewing, and approving these requests.

Stay in control of data privacy by imposing strong security controls, like encryption, to help prevent accidental leaks of sensitive data. With Box KeySafe, all key usage is unchangeable and includes a detailed record of key usage, so you can track exactly why your organization’s keys are being accessed — with no impact on user experience. If you see suspicious activity, your security team can cut off access to the content at any time. 

Manage data retention and deletion requirements — and retain only the files you need. Set retention periods on content collected for data subject requests to automatically delete after a request is fulfilled. Dispose of data when it’s no longer needed for data minimization requirements. And simplify consumer requests by reducing the content volume associated with data subject requests.

With a central repository for personal information, you limit the attack surface for stored PII and maintain precise control over shared links (plus, you manage how data is accessed and for how long). Automated classification lets you identify and protect PII so it’s only shared with appropriate users, mitigating the threat of data leakage. Threat-detection capabilities also reduce risk by quickly detecting content-centric threats.