Tableau helps you see, understand and protect your data.
Tableau has always believed in the importance of handling personal data in a way that is both thoughtful and comprehensive. We will continue to protect customer data in accordance with privacy laws, including GDPR and CCPA. We believe these privacy laws are important steps toward clarifying and enabling individual privacy rights. We want to help you focus on your core business while efficiently preparing for and complying with global privacy regulations.
The General Data Protection Regulation (GDPR), effective 25 May 2018, strengthens and unifies data protection for all individuals in the European Economic Area (EEA). The GDPR imposes enhanced rules on companies, government agencies, non-profits, and other organizations that offer goods and services to people in the EEA, or that collect and analyze data tied to EEA residents. The GDPR applies to all organizations doing business with individuals in the EEA, whether the organizations are based in the EEA or not. It also addresses the export of personal data outside the EEA, so companies need to take a measured approach to their personal data collection and protection practices.
The California Consumer Privacy Act (CCPA), effective 1 January, 2020, represents the highest standard of data protection in the United States so far. It grants California residents a number of rights over their personal data, such as the right to have certain personal data deleted, the right to be notified about a company’s collection and processing of their personal data, the right to information about how a company uses their personal data, and the right not to have companies sell their personal data.
Tableau is committed to creating customers for life. Earning the generational trust of the world’s data users requires a relentless focus on the customer experience, a fundamental component of which is safeguarding your data.
Our commitment to you.
TABLEAU PRODUCTS AND THE GENERAL DATA PROTECTION REGULATION
Tableau users subject to privacy regulations need to be aware of their obligations. Download our whitepaper to understand the ways Tableau products can help you meet your obligations.
The GDPR restricts the export of personal data to countries outside the EU and the European Economic Area (EEA) unless certain controls are in place. Tableau gives its customers assurances that personal data will be transferred and processed in compliance with EU data protection law in multiple ways.
In addition, Tableau offers customers Model Clauses that make specific guarantees around transfers of personal data for in-scope Tableau services.
In committing contractually to both the Privacy Shield Framework and the Model Clauses, Tableau has invested in the operational processes necessary to meet the exacting requirements of European data privacy requirements.
GDPR requires that personal information is subject to certain contractual protections as it transfers between controller and processor. To ensure contractual protections for our customers using our Tableau Online products, we have created a GDPR-ready Data Processing Agreement (DPA). Partners receive a DPA as part of onboarding and/or renewal.
It is likely that your written contract with Tableau (the End User License Agreement or Subscription Agreement) contains terms that satisfy the requirements of the CCPA. However, if customers prefer a separate written agreement, Tableau has prepared a CCPA addendum which is available by contacting your account representative.
Tableau collects personal information for marketing purposes only pursuant to GDPR and other local laws. Marketing communications are easily opted out of at any time, either through an unsubscribe button on the email itself, or by contacting email@example.com.
Information Security Practices
We have published informational security and data protection practices governing when employees and contractors can access data stores containing your data.
Third Party Audits and Certifications
Tableau’s controls have been audited by independent third parties against defined standards and makes SOC 2 Type II and SSAE 16 SOC 1 reports available to customers.
We have implemented a data breach and incident response plan. In case of an incident involving your customer data, we will inform you per the terms of your agreement with us.
Best Practices for Tableau customers
Apart from following the security hardening best practices for Tableau Server, the best thing our customers can do to reduce their exposure under any privacy law is to not collect or store personal data that isn’t needed.
Additionally, customers should ensure that only those people who have the need to see personal data are able to do so. The rich permissions settings on Tableau Server and Tableau Online allow control of which assets users are able to access, such as sites, workbooks, worksheets, and data sources.
We will keep you informed on our progress with updates to this site. Should you have additional concerns or questions you would like to discuss, please do not hesitate to contact us at firstname.lastname@example.org.