Rubrik moved EU data transfers onto Binding Corporate Rules.
In September 2026, Rubrik’s Data Processing Addendum began stating that transfers of personal data outside the EEA are covered by its Processor Binding Corporate Rules, approved by a supervisory authority on June 30, 2026. Standard Contractual Clauses apply where those rules don’t.
In August 2026, its Licensing Guide added Amazon Bedrock as an LLM provider for Rubrik Agent Cloud, alongside Microsoft Azure OpenAI Service.
The Licensing Guide says customer data will not be used to train or fine-tune models without the customer’s consent.
What Rubrik’s documents say about client data.
Quoted from the current version of each document. The right-hand column shows how many of the 75 vendors we monitor have a matching clause.
Using customer data to train AI
Addressed“Customer Inputs and Outputs to AI Solutions are Customer Data. Customer Data will not be used to train or fine-tune Models without Customer's consent.”
Sharing data with third parties
Addressed“Rubrik may disclose your personal information to the following third parties, and as otherwise described in this Privacy Policy, in other applicable notices, or at the time of collection …”
What changed, and when.
Notable changes since monitoring began in March 2026, newest first. Each is written from our automated comparison of the before and after versions, then reviewed by a person.
Based EU data transfers on newly approved Binding Corporate Rules
Processor BCRs approved June 30, 2026 now cover transfers outside the EEA. SCCs apply where BCRs don’t, or where the customer chooses them.
Added Amazon Bedrock as an LLM provider for Rubrik Agent Cloud
Joins Microsoft Azure OpenAI Service and pre-trained open-source models in the Licensing Guide’s AI Solutions section.
+ 17 other updates detected, such as formatting, page layout and wording changes.
- Sep 28, 2026: Rubrik Privacy Policy
- Sep 28, 2026: Data Privacy Framework Notice
- Sep 14, 2026: Legal Center
- Sep 13, 2026: Privacy Policy
- Sep 12, 2026: Rubrik Enterprise Edition Ransomware Recovery Warranty Agreement
- Sep 10, 2026: Legal Center
- Sep 9, 2026: Privacy Policy
- Sep 8, 2026: Rubrik Enterprise Edition Ransomware Recovery Warranty Agreement
24 Rubrik documents.
Sub-documents are other Rubrik documents that its policies link to, such as addenda and product terms. We list the ones identified so far; there may be others.
Who else touches the data.
Third parties Rubrik names in its own documents.
Rubrik terms: common questions.
Does Rubrik train AI models on customer data?
Rubrik’s Licensing Guide says inputs and outputs of its AI Solutions are customer data, and that customer data will not be used to train or fine-tune models without the customer’s consent.
How does Rubrik transfer EU personal data?
Since September 2026, Rubrik’s DPA says transfers outside the EEA are covered by its Processor Binding Corporate Rules, approved June 30, 2026, with Standard Contractual Clauses as the fallback.
Which AI providers does Rubrik use?
Its Licensing Guide names Amazon Bedrock and Microsoft Azure OpenAI Service, plus pre-trained open-source models, as LLM providers for Rubrik Agent Cloud.