TL;DR
Box is a complex tool that has multiple products within a single app.
Even though all its tools are designed to be GDPR compliant, it all boils down to how is used and whether the necessary steps are taken to protect user PII.
- How to maintain GDPR compliance with Box
- Do I need a cookie banner with Box?
- What Box’s Privacy Policy/GDPR page says
How to maintain GDPR compliance with Box
Box as a tool is outright GDPR compliant, but it’s also important that you, as a user, take the necessary steps to ensure it remains GDPR compliant.
Here are some must follow steps to ensure GDPR compliance with Box.
Add Box to your privacy policy
There are several tools under Box, such as Box Relay and Box Forms, which may interact with user PII.
As per GDPR law, it’s mandatory for all businesses to list data sub-processors, and if, in your case, Box receives user PII, then adding it is necessary.
Here’s how you need to mention Box in your privacy policy page
Setup SOPs to delete user PII
According to GDPR law, you are supposed to delete all user PII when the user requests an account or data deletion. In such cases it’s important to ensure that all user data is removed from Box in a set time frame.
This data removal process should be a part of your regular data cleaning process in order to remain compliant with GDPR.
Monitor data security
According to Article 33 of the GDPR law, it is mandatory to notify users in the event of a data breach. To comply with this, it is essential to monitor Box to ensure no data breaches are reported by them. While such incidents are unlikely, they remain a possibility.
Additionally, it’s recommended that you ensure security by having a strong password with Multi-Factor Authentication (MFA) enabled. Even though it's not mandatory, doing this will help you with any possible data leaks due to account hacking, which may cause legal trouble.
Do I need a cookie banner with Box?
No – as Box doesn’t store any third-party cookies on your website, you don’t need a cookie banner.
What Box’s Privacy Policy/GDPR page says
Summary of "Meet the Highest Bar for Data Protection in the EEA and U.K." (Box.com/GDPR):
Box places a strong emphasis on data protection and privacy, particularly for customers in the European Economic Area (EEA) and the United Kingdom (U.K.). The company highlights its deep commitment to helping businesses meet their data protection obligations, offering robust security, and maintaining transparency and control for customers. The site details Box’s alignment with evolving global privacy laws—including GDPR and UK Data Protection Act—while ensuring easy lawful data transfer mechanisms and compliance with the strictest privacy requirements.
Key Points:
- GDPR & UK Data Protection Compliance:
- Box assists organizations with data handling and transfers in the EEA and U.K., strictly adhering to GDPR and U.K. data protection laws.
- The company responds proactively to regulatory changes, such as the Court of Justice of the European Union's (CJEU) Schrems II decision, Brexit, and new Standard Contractual Clauses (SCCs).
- International Data Transfer Mechanisms:
- Box will certify to the new EU-U.S., UK-U.S., and Swiss-U.S. Data Privacy Frameworks.
- Updated agreements allow customers to use current EU SCCs and UK SCCs to assure legal data transfers.
- Timeline is provided for adoption of new SCCs in customer contracts.
- Strong Commitment to Privacy:
- Box provides detailed Due Diligence and Supplementary Measures Reports to help customers fulfill obligations as data controllers and comply with GDPR Article 28.
- The Data Processing Addendum (DPA) now includes all necessary legal updates for seamless compliance.
- Key Product Offerings for Compliance:
- Box Zones: Supports multi-region data residency.
- Box KeySafe: Enables advanced encryption key management with full customer control.
- Box Governance: Assists with data retention compliance.
- Box Shield: Detects and protects against malware attacks.
- Extending Data Protection Globally:
- CCPA: Box supports compliance with the California Consumer Privacy Act, making data localization, minimization, and user rights easy to manage.
- APEC Certifications: Certified under APEC Cross-Border Privacy Rules and Privacy Recognition for Processors, aiding compliance across Asia-Pacific.
- Certifications & Security Practices:
- Maintains certifications like Germany’s C5, Trust Cloud Data Protection Profile (TCDP), and Binding Corporate Rules (BCRs).
- Transparent use of subprocessors, with full listings and due diligence processes.
- Customer Resources & Support:
- White papers, blog posts, compliance documents, and direct support for DPA signing requests.
- Trust Center offers in-depth security, privacy, and compliance resources.
Pointers:
- Box continuously updates its compliance programs to match new laws and guidance in Europe and globally.
- Customers receive robust tools for privacy management—encryption, residency, governance, and threat protection.
- Box helps organizations remain legally shielded for international data transfers via updated contracts and certifications.
- Both technical and organizational safeguards are provided, and detailed reports are available upon request.
- The platform is designed to exceed industry standards in privacy and security, supporting business in highly regulated industries.
Actions:
- To review or sign the Data Processing Addendum (DPA), customers can request this directly through Box’s provided links.
- For more information or specific compliance resources, customers are directed towards the Trust Center or to contact Box directly.