SAP’s Response to Third Party Requests to Access Customer Data Stored in SAP’s Cloud Services
Overview of SAP’s approach to handling third-party legal requests for access to customer data stored in SAP Cloud Services, including legal safeguards, customer notification procedures, and compliance principles. Ladda ner dokumentetPUBLIC
SAP’s Response to Third Party Requests to
access Customer Data stored in SAP Cloud
Services
SAP’ Legal and Procedural Approach
November 7, 2025
The information contained in this document is for general informational purposes only and is
provided on the understanding that SAP is not engaged in rendering legal advice. SAP accepts
no liability for any actions taken in response to this resource. As such, it should not be used as a
substitute for legal or professional consultation.
SAP’s Response to Third Party Requests to
access Customer Data stored in SAP Cloud
Services
SAP’ Legal and Procedural Approach
November 7, 2025
The information contained in this document is for general informational purposes only and is
provided on the understanding that SAP is not engaged in rendering legal advice. SAP accepts
no liability for any actions taken in response to this resource. As such, it should not be used as a
substitute for legal or professional consultation.
This document addresses common questions about how SAP handles third-party access
requests to customer data stored in SAP Cloud Services. As a business-to-business enterprise
application provider, SAP receives few direct requests from third parties such as government
agencies or similar entities (“Requesting Party”) requiring SAP to produce or disclose
information that contains or includes any customer data stored in SAP cloud services
(“Request”).
How SAP Handles Requests
Generally, customers can directly access their data stored in SAP cloud services. SAP is therefore of the opinion
that customers are best placed to identify and access their own data in response to a Request. However, if SAP
receives a Request directly from a Requesting Party, SAP will handle such Request as follows:
• All SAP employees who may receive Requests are required to promptly forward such Requests to their
appropriate legal contact. SAP has a global and regional legal team responsible for evaluating such
Requests on a case-by-case basis to determine whether such Requests are valid under applicable law.
• If SAP receives a Request from a Requesting Party, the Requesting Party must follow applicable legal
process. SAP will review all such Requests under applicable laws before taking any action.
• To the extent permitted under applicable law, SAP will redirect the Request and advise the Requesting
Party that all customer data stored in any SAP customer cloud system belongs to the customer, not to SAP,
and that such data is confidential. SAP cannot and will not produce or disclose such information without
first fulfilling its contractual obligation to notify the customer, allowing the customer to consent, object, or
seek a protective order.
• If the Requesting Party prohibits SAP from providing such notice to the customer, then SAP will seek to
challenge the Request if it is invalid or unlawful under applicable laws.
• If a competent court issues a ruling compelling SAP to comply with a Request without prior notice to the
customer, SAP will challenge the ruling where legally permissible and where SAP has a good faith basis
under applicable law to do so.
• If no such recourse exists, or if SAP’s attempt to challenge the ruling on appeal is not successful, SAP will
make all reasonable efforts to narrow the scope of the Request to the extent permitted under applicable
laws before complying with it.
To explore SAP’s approach to data protection and compliance, visit the SAP Trust Center and www.sap.com.
© 2025 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to this material. 2/2
requests to customer data stored in SAP Cloud Services. As a business-to-business enterprise
application provider, SAP receives few direct requests from third parties such as government
agencies or similar entities (“Requesting Party”) requiring SAP to produce or disclose
information that contains or includes any customer data stored in SAP cloud services
(“Request”).
How SAP Handles Requests
Generally, customers can directly access their data stored in SAP cloud services. SAP is therefore of the opinion
that customers are best placed to identify and access their own data in response to a Request. However, if SAP
receives a Request directly from a Requesting Party, SAP will handle such Request as follows:
• All SAP employees who may receive Requests are required to promptly forward such Requests to their
appropriate legal contact. SAP has a global and regional legal team responsible for evaluating such
Requests on a case-by-case basis to determine whether such Requests are valid under applicable law.
• If SAP receives a Request from a Requesting Party, the Requesting Party must follow applicable legal
process. SAP will review all such Requests under applicable laws before taking any action.
• To the extent permitted under applicable law, SAP will redirect the Request and advise the Requesting
Party that all customer data stored in any SAP customer cloud system belongs to the customer, not to SAP,
and that such data is confidential. SAP cannot and will not produce or disclose such information without
first fulfilling its contractual obligation to notify the customer, allowing the customer to consent, object, or
seek a protective order.
• If the Requesting Party prohibits SAP from providing such notice to the customer, then SAP will seek to
challenge the Request if it is invalid or unlawful under applicable laws.
• If a competent court issues a ruling compelling SAP to comply with a Request without prior notice to the
customer, SAP will challenge the ruling where legally permissible and where SAP has a good faith basis
under applicable law to do so.
• If no such recourse exists, or if SAP’s attempt to challenge the ruling on appeal is not successful, SAP will
make all reasonable efforts to narrow the scope of the Request to the extent permitted under applicable
laws before complying with it.
To explore SAP’s approach to data protection and compliance, visit the SAP Trust Center and www.sap.com.
© 2025 SAP SE or an SAP affiliate company. All rights reserved. See Legal Notice on www.sap.com/legal-notice for use terms, disclaimers, disclosures, or restrictions related to this material. 2/2