DocuSign Envelope ID: C6596B93-8ADE-4CF8-BEB3-AFECC20A41A1

AMENDMENT TO THE ZSCALER DATA PROCESSING AGREEMENT
This Amendment is entered into on the date of the last signature below (the “Amendment Effective Date”) by and between Zscaler, Inc.
(“Zscaler”) and ____________________________________________________ (“Customer”).
WHEREAS, the parties executed a Data Processing Agreement (“DPA”), and now wish to amend the DPA by adding Exhibit E (The California Privacy
Protection Act and the California Consumer Privacy Act Addendum) (attached hereto) as a new exhibit.
Except as set forth in this Amendment, the DPA is unaffected and shall continue in full force and effect in accordance with its terms. If there isconflict between this Amendment (including the exhibits) and the DPA (including the exhibits), then this Amendment will prevail.
IN WITNESS WHEREOF, the parties agree as of the Amendment Effective Date as attested by the signatures of their duly authorized
representatives:

CUSTOMER:ZSCALER, INC.

Signature: _______________________________________________

Signature:________________________________________________

Printed Name: ___________________________________________

Printed Name: ____________________________________________

Title: ___________________________________________________

Title: ____________________________________________________

Date Signed: _____________________________________________

Date Signed:______________________________________________

Shaun Ghafouri
VP, Associate General Counsel

March 7, 2023 | 12:12 PM PST

Zscaler, Inc. – CONFIDENTIAL © 2023
Data Processing Amendment (January 2023)

Page 1 of 3

DocuSign Envelope ID: C6596B93-8ADE-4CF8-BEB3-AFECC20A41A1

Exhibit E
The California Privacy Protection Act and the California Consumer Privacy Act Addendum
This Exhibit E (The California Privacy Protection Act and the California Consumer Privacy Act Addendum) is entered into by the parties effective
as of the date of last signature of the Agreement (defined below) and incorporated by reference in the Agreement. Capitalized terms not defined
herein shall have the meanings assigned to such terms in the Agreement.
1.

Definitions.
1.1
Terms used but not defined in the Addendum, such as “commercial purpose”, “process” or “processing”, and “sale” will
have the same meaning as set forth in California Civil Code Section 1798.140.
1.2“Agreement” means any agreement between Zscaler and a specific customer or between a specific customer and a Zscalerauthorized partner under which Products are provided by Zscaler and/or a Zscaler-authorized partner to that customer. Such anagreement may have various titles, such as “Order Form”, “Quotation”, “Purchase Order”, “End User Subscription Agreement”, or“Master Services Agreement”.
1.3“Business Purpose” means the use of Customer Personal Information for the Service Provider’s operational purposes, orother notified purposes, provided that the use of Customer Personal Information shall be reasonably necessary and proportionate toachieve the operational purpose for which the Customer Personal Information was collected or processed or for another operational
purpose that is compatible with the context in which the Customer Personal Information was collected. For clarity, the Business
Purpose herein shall mean Zscaler providing the Products to Customer in accordance with the Agreement.
1.4“California Consumer Privacy Act of 2018 (CCPA)” means the California Civil Code § 1798.100 et. seq., and its implementing
regulations.
1.5“California Privacy Rights Act of 2020 (CPRA)” means the ballot initiative amending the CCPA which includes additional
privacy protections for California consumers passed in November 2020, and its implementing regulations.
1.6“Customer Personal Information” means personal information as defined in has the meaning given in Cal. Civ. Code §1798.140(v) that is submitted to the Products by Customer and processed by Zscaler for the purposes of providing the Products to
Customer and that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly orindirectly, with a particular consumer or household, to the extent that such information is protected as “personal information” underthe CCPA.
1.7“Service Provider” has the same meaning set forth in Cal. Civ. Code § 1798.140(v).

2.
Application. This Exhibit E only applies to the extent Zscaler processes Personal Information within the scope of the CCPA in thecourse of providing the Products to Customer.
3.
Roles of the Parties. The parties acknowledge and agree that with regard to the processing of Customer Personal Information,Zscaler is the Service Provider who receives Customer Personal Information pursuant to the Business Purpose of providing the Products toCustomer in accordance with the Agreement.
4.
Business Purposes. Zscaler will process Customer’s Personal Information only for the permissible Business Purpose of providing theProducts to Customer in accordance with the terms of this Exhibit E and the Agreement.
5.
No Sale of Customer Personal Information. Customer and Zscaler hereby acknowledge and agree that in no event shall the transferof Customer Personal Information from Customer to Zscaler pursuant to the Agreement constitute a sale of Customer Personal Information toZscaler, and that nothing in the Agreement shall be construed as providing for the sale of Customer Personal Information to Zscaler. Zscaler
certifies that it understands these restrictions in this Section and will comply with them.

Zscaler, Inc. – CONFIDENTIAL © 2023
Data Processing Amendment (January 2023)

Page 2 of 3

DocuSign Envelope ID: C6596B93-8ADE-4CF8-BEB3-AFECC20A41A1

6.
Limitations on Use and Disclosure. Zscaler is prohibited from using or disclosing Customer Personal Information for any commercial
purpose other than the specific Business Purpose of providing the Products to Customer or as otherwise required by applicable Data Protection
Legislation, the CCPA, the CPRA, or other applicable law. Zscaler certifies that it understands these restrictions in this Section and will complywith them.
7.
Reasonable Security. Zscaler shall implement and maintain reasonable security procedures and practices appropriate to the natureof the information, to protect any Customer Personal Information as defined in Cal. Civ. Code § 1798.81.5 from unauthorized access,destruction, use, modification, or disclosure.
8.
Changes in Law. If there is a change in the law, more specifically in the CCPA or CPRA affecting this Exhibit E, the parties agree tonegotiate in good faith any necessary changes to this Exhibit E.
9.
Severability. If any provision of this Exhibit E is determined to be unenforceable by a court of competent jurisdiction, that provision
will be severed, and the remainder of terms will remain in full effect.

Zscaler, Inc. – CONFIDENTIAL © 2023
Data Processing Amendment (January 2023)

Page 3 of 3