To:

Teradata Customer Legal/Privacy Teams (as applicable)

From:

Teradata Privacy Legal Team

Re:

Notice of Amended Privacy Laws, including revised Standard
Contractual Clauses (EU & Swiss SCCs & UK Clauses) and CPRA

Dear Teradata Customer,
We are writing to you in relation to Teradata’s provision of goods or services to you under a master orother governing agreement and the related data processing agreement or addendum (collectively, the“Agreement”). Teradata complies with the laws applicable to the goods and services provided to ourCustomers. This includes relevant privacy laws. This Notice recognizes recent updates to certain privacy
laws and explicitly acknowledges Teradata’s continued compliance with such laws.
Replacement of Old SCCs with New SCCs Under GDPR & Swiss and UK Clauses
On June 4, 2021, the European Commission published new standard contractual clauses (“New SCCs”)
for international transfers of personal data to countries outside of the European Economic Area (“EEA”).
Under the General Data Protection Regulation (“GDPR”), such transfers must meet certain conditions tobe lawful (“Conditions”). The New SCCs are an EEA-approved mechanism to enable companies
transferring personal data outside of the EEA to meet those Conditions. They replace the previous set ofstandard contractual clauses (“Old SCCs”), which were deemed inadequate by the Court of Justice of theEuropean Union. The European Commission requires that all companies relying on the standard
contractual clauses as a mechanism to transfer personal data outside of the EEA implement the New
SCCs by December 27, 2022.
To the extent that our current Agreement with you incorporates the Old SCCs, or requires the additionof the New SCCs to meet the Conditions, Teradata hereby notifies you that such Agreement is amended:i)ii)
iii)

to replace the Old SCCs with, or to add, the New SCCs, where required, for the transfer ofpersonal data outside of the EEA, andto include, as applicable, the UK International Data Transfer Agreement VERSION A1.0, in force
21 March 2022 (“UK Clauses”), andto include, as applicable, the necessary amendments to the New SCCs for transfers of personal
data from Switzerland (“Swiss Clauses”), all occurring from the Effective Date below.

All references in the Agreement to the Old SCCs in the Agreement will now correspond to the New
SCCs, UK Clauses, and Swiss Clauses, as applicable. Such changes are reflected in Section 11 of
Teradata’s updated Data Processing Addendum (“DPA”).
In respect of any proposed transfer by Teradata that relates to an Agreement, regardless of the updates
herein, Teradata shall only make such transfers using the New SCCs, the UK Clauses, or the Swiss
Clauses, as appropriate, or another lawful transfer mechanism, and in accordance with yourdocumented instructions. Any such transfer will be carried out in accordance with the conditions

stipulated in chapter V of the GDPR, the UK GDPR, and the Swiss Federal Act on Data Protection, asapplicable.
Agreement Not to Sell or Share Personal Information under the CPRA
In November 2020, California voters passed Proposition 24, the California Privacy Rights Act (“CPRA”).
The CPRA amends and extends the California Consumer Privacy Act of 2018 and shall become generally
operative on January 1, 2023. The CPRA includes additional contracting requirements for vendors such
as Teradata.
To the extent that the CPRA is applicable to the good and services we provide to you, we shall continue
to comply with its requirements, including that Teradata:•••••

Shall not Sell or Share a consumer’s personal information, as these terms are defined under
California Civil Code Sections 1798.140(ad) and 1798.140(ah);Shall obligate any third party, service provider, or contractor to comply with applicableobligations under the CPRA and obligate those persons to provide the same level of privacy
protection as is required by the CPRA;
Grants you the right to take reasonable and appropriate steps to help ensure that Teradata andany authorized third party, service provider, or contractor use the personal informationtransferred in a manner consistent with the business’ obligations under the CPRA;
Shall notify you if Teradata determines that we can no longer meet our obligations under theCPRA; andGrants you the right, upon notice, to take reasonable and appropriate steps to stop andremediate unauthorized use of personal information.

Conclusion
Except as required to comply with governing law, this Notice in no way alters any terms or conditions
contained in the Agreement. Rather, it amends the Agreement to recognize the parties’ continued
compliance with any applicable laws and adherence to the recent changes described above.
As applicable, the amendments listed above are incorporated into the Agreement from the Effective
Date below. For the avoidance of doubt, receipt of this Notice shall be deemed to constitute acceptanceof the New SCCs, UK Clauses, Swiss Clauses, and the CPRA amendments to the extent they are required
to comply with applicable law.
You do not need to take any further action to incorporate the updated DPA or the New SCCs, the UK
Clauses, the Swiss Clauses, or CPRA amendments into your agreement with Teradata.
Effective Date: Changes regarding New SCCs under GDPR and the New Swiss and UK Clauses will comeinto effect on December 27, 2022. The changes regarding CPRA will come into effect on 1st January 2023.
For information on how Teradata collects, uses, and discloses personal data, as well as the choices
available regarding the personal data Teradata collects and processes, please read the Teradata Privacy
Policy. For questions about our privacy program or practices, please email our Privacy Team at
privacy@teradata.com.