This is GitHub's General Privacy Statement, effective April 27, 2026
The document is the GitHub General Privacy Statement with a stated effective date of April 27, 2026. Only this dated version is analyzed; earlier or later versions are not supplied.
Supporting quotations
GitHub General Privacy Statement
Effective date: April 27, 2026
Qualifications & exceptions
The date is the effective date printed on the saved version; no successor version is supplied.
Legal Rights & Agreement Rules · Context
With an organization account, GitHub is Data Controller only for activities defined in the Data Protection Agreement
Where your organization grants access to GitHub products, GitHub acts as Data Controller only for specific processing activities defined in the Data Protection Agreement with your organization. For those limited purposes this Statement governs how your Personal Data is handled; for all other aspects of your GitHub product use, your organization's policies apply. GitHub links its standard Data Protection Agreement.
Supporting quotations
In cases where your organization grants access to GitHub products, GitHub acts as the Data Controller solely for specific processing activities.
These activities are clearly defined in a contractual agreement with your organization, known as a Data Protection Agreement.
For those limited purposes, this Statement governs the handling of your Personal Data. For all other aspects of GitHub product usage, your organization's policies apply.
Qualifications & exceptions
Which activities GitHub controls is defined in the Data Protection Agreement, which is linked but not supplied here.
Not stated here
The specific processing activities for which GitHub is controller are not listed in this Statement.
Personal Data is used to meet legal obligations, including Data Subject Requests, tax, agreements and disputes
GitHub uses Personal Data to comply with and resolve legal obligations, including responding to Data Subject Requests for Personal Data it processes as Controller (for example website data), tax requirements, agreements and disputes.
Supporting quotations
Complying with and resolving legal obligations: including responding to Data Subject Requests for Personal Data processed by GitHub as Controller (for example website data), tax requirements, agreements and disputes.
When carrying out these activities, GitHub practices data minimization and uses the minimum amount of Personal Information required.
Qualifications & exceptions
GitHub says it practices data minimization and uses the minimum Personal Information required for these activities.
The Data Subject Request example covers Personal Data GitHub processes as Controller.
Legal Rights & Agreement Rules · Company practice
GitHub may disclose data to law enforcement, regulators and courts on lawful request or to protect its rights
GitHub may disclose Personal Data to authorized law enforcement, regulators, courts or other public authorities in response to lawful requests or to protect its rights and safety. More detail is in GitHub's Guidelines for Legal Requests of User Data, which is linked but not supplied.
Supporting quotations
We may share Personal Data with the following recipients:
We may disclose Personal Data to authorized law enforcement, regulators, courts, or other public authorities in response to lawful requests or to protect our rights and safety.
Qualifications & exceptions
Disclosure can also happen "to protect our rights and safety", not only on a lawful request.
The linked legal-request guidelines are not supplied.
Legal Rights & Agreement Rules · Context
For EEA and UK users, GitHub relies on a lawful basis under the GDPR that varies by data and context
For EEA and UK end users, GitHub says it processes Personal Data in compliance with the GDPR with a lawful basis for each processing activity. The basis varies with the data type and context, including how you access the Services, and typically falls under contractual necessity, legal obligation, legitimate interests or consent.
Supporting quotations
Lawful Bases for Processing Personal Data (Applicable to EEA and UK End Users)
GitHub processes Personal Data in compliance with the GDPR, ensuring a lawful basis for each processing activity.
The basis varies depending on the data type and the context, including how you access the services.
Qualifications & exceptions
The heading limits this section to EEA and UK end users.
The GDPR is an external law; its content is not supplied by this Statement.
Not stated here
The Statement does not map each purpose to a specific lawful basis.
Legal Rights & Agreement Rules · Context
EEA/UK: contractual necessity and legal obligation are lawful bases for processing
For EEA and UK end users, GitHub processes data when required to fulfill its contractual duties to you under the GitHub Terms of Service, and when necessary to comply with applicable laws or to protect the rights, safety and property of GitHub, its affiliates, users or third parties.
Supporting quotations
Lawful Bases for Processing Personal Data (Applicable to EEA and UK End Users)
Contractual Necessity: Processing is required to fulfill our contractual duties to you, in accordance with the GitHub Terms of Service.
Legal Obligation: We process data when it's necessary to comply with applicable laws or to protect the rights, safety, and property of GitHub, our affiliates, users, or third parties.
Qualifications & exceptions
The legal-obligation item also covers protecting rights, safety and property of GitHub, affiliates, users or third parties.
Legal Rights & Agreement Rules · Context
EEA/UK: GitHub relies on legitimate interests for security, communication and AI development
For EEA and UK end users, GitHub processes data for purposes in its legitimate interests, such as securing the Services, communicating with you, and developing and improving the Services including artificial intelligence and machine learning technologies. It does so only when those interests are not overridden by your data protection rights or fundamental rights and freedoms.
Supporting quotations
Lawful Bases for Processing Personal Data (Applicable to EEA and UK End Users)
We process data for purposes that are in our legitimate interests, such as securing our Services, communicating with you, and developing and improving our Services, which include artificial intelligence and machine learning technologies.
This is done only when these interests are not overridden by your data protection rights or your fundamental rights and freedoms.
Qualifications & exceptions
Limited to cases where GitHub's interests are not overridden by your rights and freedoms.
Legal Rights & Agreement Rules · User right or choice
EEA/UK: where processing relies on consent, you can withdraw it at any time
For EEA and UK end users, GitHub processes some data because you explicitly consented. Where consent is the legal basis, you can withdraw it at any time; GitHub says withdrawal procedures are in this Statement and on its website.
Supporting quotations
Lawful Bases for Processing Personal Data (Applicable to EEA and UK End Users)
Consent: We process data when you have explicitly consented to such processing. When we rely on consent as the legal basis, you have the right to withdraw your consent for data processing at any time.
The procedures for withdrawal are detailed in this Statement and available on our website.
Not stated here
Which processing relies on consent is not listed here.
Legal Rights & Agreement Rules · User right or choice
Depending on region, you can complain to your local Data Protection Authority, such as the UK ICO
Depending on your region, you have the right to complain to your local Data Protection Authority. European users can find authority contacts on the European Data Protection Board website and UK users on the Information Commissioner's Office website.
Supporting quotations
Depending on your region, you have the right to complain to your local Data Protection Authority.
European users can find authority contacts on the European Data Protection Board website, and UK users on the Information Commissioner’s Office website.
Qualifications & exceptions
Available depending on your region.
Legal Rights & Agreement Rules · Company practice
Transfers from the EU, UK and Switzerland to non-adequate countries generally rely on standard contractual clauses
GitHub transfers Personal Data from the European Union, the United Kingdom and Switzerland to countries the European Commission has not recognized as providing adequate protection. For such transfers it generally relies on the standard contractual clauses published by the European Commission under Commission Implementing Decision 2021/914, to help your protections travel with your data.
Supporting quotations
We transfer Personal Data from the European Union, the United Kingdom, and Switzerland to countries that the European Commission has not recognized as having an adequate level of data protection.
When we engage in such transfers, we generally rely on the standard contractual clauses published by the European Commission under
Qualifications & exceptions
GitHub "generally" relies on standard contractual clauses, so other mechanisms (such as the Data Privacy Framework described separately) may apply.
The Commission decision is an external legal instrument and is not supplied.
Legal Rights & Agreement Rules · Company commitment
GitHub is certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the UK Extension
GitHub says it complies with the EU-U.S. Data Privacy Framework, the UK Extension to it and the Swiss-U.S. Data Privacy Framework as set by the U.S. Department of Commerce, and has certified that it adheres to the related Principles for personal data received from the EU, the UK (and Gibraltar) and Switzerland in reliance on those frameworks. If this Statement conflicts with the EU-U.S. or Swiss-U.S. DPF Principles, the Principles govern.
Supporting quotations
GitHub also complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.
GitHub has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF.
If there is any conflict between the terms in this privacy statement and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.
Qualifications & exceptions
Applies to personal data received in reliance on the frameworks from the EU, UK (and Gibraltar) and Switzerland.
The DPF Principles are external and not supplied here.
Legal Rights & Agreement Rules · Company commitment
GitHub stays liable under the DPF if its agents mishandle transferred data, unless it proves it is not responsible
GitHub is responsible for personal data it receives under the DPF Principles and then transfers to a third party acting as its agent. It remains liable under the Principles if the agent processes the data inconsistently with them, unless it proves it is not responsible for the event that caused the damage.
Supporting quotations
GitHub has the responsibility for the processing of Personal Data it receives under the Data Privacy Framework (DPF) Principles and subsequently transfers to a third party acting as an agent on GitHub’s behalf.
GitHub shall remain liable under the DPF Principles if its agent processes such Personal Data in a manner inconsistent with the DPF Principles, unless the organization proves that it is not responsible for the event giving rise to the damage.
Qualifications & exceptions
Liability ends if GitHub proves it is not responsible for the event giving rise to the damage.
Legal Rights & Agreement Rules · Procedure
DPF complaints go first to GitHub's DPO, then to a free independent dispute service and possibly binding arbitration
EU, UK and Swiss individuals with DPF-related inquiries or complaints should first contact GitHub at dpo[at]github[dot]com. If GitHub does not acknowledge the complaint in a timely way or does not resolve it to your satisfaction, you can use the International Centre for Dispute Resolution service at no cost to you. Under certain conditions you may invoke binding arbitration for DPF complaints not resolved by the other DPF mechanisms.
Supporting quotations
GitHub commits to resolve DPF Principles-related complaints about our collection and use of your personal information.
EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension, and the Swiss-U.S. DPF should first contact GitHub at: dpo[at]github[dot]com.
If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit
The services of the International Centre for Dispute Resolution are provided at no cost to you.
An individual has the possibility, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms.
Qualifications & exceptions
Limited to complaints about personal data received in reliance on the DPF.
Binding arbitration is available only under certain conditions and after other DPF mechanisms.
Not stated here
The conditions for arbitration are on an external page not supplied.
Legal Rights & Agreement Rules · Context
GitHub is subject to FTC enforcement of its DPF commitments
GitHub is subject to the investigatory and enforcement powers of the Federal Trade Commission. Under Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45), failing to keep DPF commitments may be challenged as deceptive by the FTC, which can prohibit such misrepresentations through administrative orders or court orders.
Supporting quotations
GitHub is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).
Under Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45), an organization's failure to abide by commitments to implement the DPF Principles may be challenged as deceptive by the FTC.
Qualifications & exceptions
Section 5 of the Federal Trade Commission Act is an external law cited by the Statement; its text is not supplied.
Legal Rights & Agreement Rules · Procedure
Contact GitHub through its contact form or the Data Protection Officer; GitHub B.V. and GitHub, Inc. addresses are given
You can contact GitHub through its contact form or by emailing its Data Protection Officer at dpo[at]github[dot]com. The listed addresses are GitHub B.V. in Amsterdam, the Netherlands, and GitHub, Inc. in San Francisco, United States.
Supporting quotations
Contact us via our contact form or by emailing our Data Protection Officer at dpo[at]github[dot]com.
GitHub B.V. Prins Bernhardplein 200, Amsterdam 1097JB The Netherlands
GitHub, Inc. 88 Colin P. Kelly Jr. St. San Francisco, CA 94107 United States
Legal Rights & Agreement Rules · Company commitment
Material changes to the Statement get at least 30 days' notice by website update or email
GitHub may revise the Statement periodically. For material changes it will give at least 30 days' prior notice by updating its website or by emailing the primary email address on your GitHub account.
Supporting quotations
GitHub may periodically revise this Privacy Statement.
If there are material changes to the statement, we will provide at least 30 days prior notice by updating our website or sending an email to your primary email address associated with your GitHub account.
Qualifications & exceptions
The 30-day notice applies only to material changes, and a website update alone can count as notice.
Not stated here
What counts as a material change is not defined.
Legal Rights & Agreement Rules · Context
The English version controls over translations; a French PDF and other languages are offered
The Statement offers translations, including a French version as a PDF and other languages through the docs site's language menu. If any translation conflicts with, is uncertain against or appears inconsistent with the English version, the English version controls.
Supporting quotations
In the event of any conflict, uncertainty, or apparent inconsistency between any of those versions and the English version, this English version is the controlling version.
Cliquez ici pour obtenir la version française: Déclaration de confidentialité de GitHub (PDF).
For translations of this statement into other languages, please visit
Qualifications & exceptions
The translations themselves are not supplied; only the English text is analyzed.
Legal Rights & Agreement Rules · Context
Extra rights apply to residents of certain US states with their own privacy laws, once those laws take effect
The US State Specific Information section gives extra information for residents of certain US states with distinct privacy laws, which may grant specific rights when they come into effect. In this section "personal information" means the same as "Personal Data".
Supporting quotations
US State Specific Information
This section provides extra information specifically for residents of certain US states that have distinct data privacy laws and regulations. These laws may grant specific rights to residents of these states when the laws come into effect.
This section uses the term “personal information” as an equivalent to the term “Personal Data.”
Qualifications & exceptions
Rights depend on the state law applying to you and on that law being in effect.
Legal Rights & Agreement Rules · Procedure
Questions about privacy practices can go to the Data Protection Officer
GitHub says it values your trust and is committed to handling your personal information with care and respect, and invites questions or concerns to its Data Protection Officer at dpo[at]github[dot]com.
Supporting quotations
If you have any questions or concerns about our privacy practices, please email our Data Protection Officer at dpo[at]github[dot]com.