GitHub General Privacy Statement

Legal Rights & Agreement Rules · Context

The Statement covers Personal Data that GitHub, Inc. or GitHub B.V. controls across Services that display it

This is the General Privacy Statement for websites, applications and services that display it (called the "Services"). It describes how GitHub handles "Personal Data", defined as information that is directly linked or can be linked to you, when GitHub, Inc. or GitHub B.V. acts as the "Data Controller". The Statement is global in its wording; it does not name a single country or a single type of user in this opening.

Supporting quotations

Welcome to the GitHub Privacy Statement. This is where we describe how we handle your “Personal Data”, which is information that is directly linked or can be linked to you. It applies to the Personal Data that GitHub, Inc. or GitHub B.V., processes as the “Data Controller” when you interact with websites, applications, and services that display this Statement (collectively, “Services”).

which is information that is directly linked or can be linked to you

Qualifications & exceptions

• Applies where GitHub, Inc. or GitHub B.V. processes the data as Data Controller.

Not stated here

• The source does not list which websites, applications and services display the Statement.

Legal Rights & Agreement Rules · Restriction or exception

Services or products that do not display this Statement, such as Previews, are outside it

The Statement does not apply to services or products that do not display it. Previews are given as an example. The source adds "where relevant", so it does not say that every Preview is always outside the Statement.

Supporting quotations

This Statement does not apply to services or products that do not display this Statement, such as Previews, where relevant.

Qualifications & exceptions

• The source qualifies the exclusion with "where relevant".

Not stated here

• The source does not say which Previews exist or what privacy terms govern them.

Legal Rights & Agreement Rules · Context

This version of the Statement states an effective date of April 27, 2026

The page states "Effective date: April 27, 2026". The source does not describe earlier or later versions in this opening.

Supporting quotations

Effective date: April 27, 2026

Legal Rights & Agreement Rules · Restriction or exception

With organization-granted product access, GitHub is controller only for activities in a Data Protection Agreement

Where your organization grants access to GitHub products, GitHub acts as Data Controller solely for specific processing activities defined in a contractual Data Protection Agreement with the organization. For those limited purposes this Statement governs the handling of your Personal Data. For all other aspects of using GitHub products, your organization's policies apply. The source links its standard Data Protection Agreement.

Supporting quotations

In cases where your organization grants access to GitHub products, GitHub acts as the Data Controller solely for specific processing activities.

For those limited purposes, this Statement governs the handling of your Personal Data. For all other aspects of GitHub product usage, your organization's policies apply.

Qualifications & exceptions

• This Statement governs only the limited purposes defined in the Data Protection Agreement; for everything else, your organization's policies apply.

Not stated here

• The source does not list the specific processing activities for which GitHub is controller; they are in the linked agreement, which is not supplied.

Cross-references

• qualifies (model-proposed): For organization-provided accounts, GitHub acts as a Data Processor following the organization's instructions — The processor card says GitHub acts as a Data Processor for organization-provided accounts. The product-access paragraph adds that where the organization grants access to GitHub products, GitHub is the Data Controller for specific processing activities defined in a Data Protection Agreement, and this Statement governs those limited purposes.

Legal Rights & Agreement Rules · Company practice

GitHub uses Personal Data to meet legal obligations, including data subject requests, tax requirements and disputes

GitHub uses Personal Data for complying with and resolving legal obligations. This includes responding to Data Subject Requests for Personal Data that GitHub processes as Controller (website data is the example given), tax requirements, agreements and disputes.

Supporting quotations

Complying with and resolving legal obligations: including responding to Data Subject Requests for Personal Data processed by GitHub as Controller (for example website data), tax requirements, agreements and disputes.

Qualifications & exceptions

• Data Subject Requests are covered for data GitHub processes as Controller.

Legal Rights & Agreement Rules · Company practice

For EEA and UK end users, GitHub says it processes Personal Data under GDPR lawful bases that vary by data and context

This section applies to EEA and UK end users. GitHub says it processes Personal Data in compliance with the GDPR and ensures a lawful basis for each processing activity. The basis varies with the data type and context, including how you access the Services. The typical bases are listed as contractual necessity, legal obligation, legitimate interests and consent.

Supporting quotations

Lawful Bases for Processing Personal Data (Applicable to EEA and UK End Users)

GitHub processes Personal Data in compliance with the GDPR, ensuring a lawful basis for each processing activity. The basis varies depending on the data type and the context, including how you access the services. Our processing activities typically fall under these lawful bases:

Qualifications & exceptions

• Section heading limits it to EEA and UK end users.

Legal Rights & Agreement Rules · Company practice

For EEA and UK users GitHub relies on contractual necessity and legal obligation as lawful bases

Contractual necessity: processing required to fulfill GitHub's contractual duties to you under the GitHub Terms of Service. Legal obligation: processing necessary to comply with applicable laws or to protect the rights, safety and property of GitHub, its affiliates, users or third parties.

Supporting quotations

Contractual Necessity: Processing is required to fulfill our contractual duties to you, in accordance with the GitHub Terms of Service.

Legal Obligation: We process data when it's necessary to comply with applicable laws or to protect the rights, safety, and property of GitHub, our affiliates, users, or third parties.

Qualifications & exceptions

• Listed in the lawful-bases section for EEA and UK end users.

Legal Rights & Agreement Rules · Company practice

For EEA and UK users GitHub relies on legitimate interests, including AI and ML development, unless overridden

Legitimate interests: GitHub processes data for purposes in its legitimate interests, such as securing the Services, communicating with you, and developing and improving the Services, which include artificial intelligence and machine learning technologies. The source says this is done only when those interests are not overridden by your data protection rights or fundamental rights and freedoms.

Supporting quotations

Legitimate Interests: We process data for purposes that are in our legitimate interests, such as securing our Services, communicating with you, and developing and improving our Services, which include artificial intelligence and machine learning technologies. This is done only when these interests are not overridden by your data protection rights or your fundamental rights and freedoms.

Qualifications & exceptions

• Only when GitHub's interests are not overridden by your data protection rights or fundamental rights and freedoms.

Legal Rights & Agreement Rules · User right or choice

Depending on your region you may complain to your local Data Protection Authority; EU and UK contact sites are named

Depending on your region, you have the right to complain to your local Data Protection Authority. The Statement says European users can find authority contacts on the European Data Protection Board website, and UK users on the Information Commissioner's Office website.

Supporting quotations

Depending on your region, you have the right to complain to your local Data Protection Authority. European users can find authority contacts on the European Data Protection Board website, and UK users on the Information Commissioner’s Office website.

Qualifications & exceptions

• Depends on your region.

Legal Rights & Agreement Rules · Company practice

For EU, UK and Swiss transfers to countries without adequacy, GitHub generally relies on standard contractual clauses

GitHub transfers Personal Data from the European Union, the United Kingdom and Switzerland to countries that the European Commission has not recognized as having an adequate level of data protection. For such transfers it generally relies on the standard contractual clauses published by the European Commission under Commission Implementing Decision 2021/914, to help protect your rights. The word "generally" means the source does not say these clauses are used in every case. The Statement also links an article on the Commission's adequacy decisions.

Supporting quotations

We transfer Personal Data from the European Union, the United Kingdom, and Switzerland to countries that the European Commission has not recognized as having an adequate level of data protection. When we engage in such transfers, we generally rely on the standard contractual clauses published by the European Commission under

Commission Implementing Decision 2021/914

to help protect your rights and enable these protections to travel with your data.

Qualifications & exceptions

• GitHub "generally" relies on the clauses; other mechanisms are not described here.

Not stated here

• The linked European Commission article is not supplied; the Statement's Data Privacy Framework section describes another mechanism.

Legal Rights & Agreement Rules · Company commitment

GitHub says it complies with and is certified to the EU-U.S., UK Extension and Swiss-U.S. Data Privacy Frameworks

GitHub states that it complies with the EU-U.S. Data Privacy Framework, the UK Extension to it, and the Swiss-U.S. Data Privacy Framework, as set forth by the U.S. Department of Commerce. It says it has certified to the Department of Commerce that it adheres to the EU-U.S. DPF Principles for personal data received from the European Union and from the United Kingdom (and Gibraltar), and to the Swiss-U.S. DPF Principles for personal data received from Switzerland, in each case in reliance on the matching framework. The Statement points to the Data Privacy Framework website to view the certification.

Supporting quotations

GitHub also complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.

GitHub has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. GitHub has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.

Qualifications & exceptions

• Covers personal data received from the EU, the UK (and Gibraltar) and Switzerland in reliance on the matching framework.

Not stated here

• The certification itself is on a linked government website that is not supplied.

Legal Rights & Agreement Rules · Restriction or exception

If this Statement conflicts with the DPF Principles, the Principles govern

The Statement says that if there is any conflict between its terms and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles govern.

Supporting quotations

If there is any conflict between the terms in this privacy statement and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.

Qualifications & exceptions

• Applies to personal data received under the Data Privacy Frameworks.

Legal Rights & Agreement Rules · Company commitment

GitHub stays liable under the DPF Principles if its agent mishandles transferred data, unless not responsible

GitHub says it has the responsibility for Personal Data it receives under the DPF Principles and then transfers to a third party acting as an agent on its behalf. It remains liable under the DPF Principles if its agent processes that data inconsistently with the Principles, unless GitHub proves that it is not responsible for the event giving rise to the damage.

Supporting quotations

GitHub has the responsibility for the processing of Personal Data it receives under the Data Privacy Framework (DPF) Principles and subsequently transfers to a third party acting as an agent on GitHub’s behalf. GitHub shall remain liable under the DPF Principles if its agent processes such Personal Data in a manner inconsistent with the DPF Principles, unless the organization proves that it is not responsible for the event giving rise to the damage.

Qualifications & exceptions

• Applies to data received under the DPF and passed to an agent acting on GitHub's behalf.
• GitHub is not liable if it proves it is not responsible for the event giving rise to the damage.

Legal Rights & Agreement Rules · Procedure

EU, UK and Swiss individuals with DPF complaints should first contact GitHub at dpo[at]github[dot]com

GitHub commits to resolve DPF Principles-related complaints about its collection and use of your personal information. EU, UK and Swiss individuals with inquiries or complaints about personal data received in reliance on the EU-U.S. DPF, the UK Extension and the Swiss-U.S. DPF should first contact GitHub at dpo[at]github[dot]com.

Supporting quotations

GitHub commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension, and the Swiss-U.S. DPF should first contact GitHub at: dpo[at]github[dot]com.

Qualifications & exceptions

• For EU, UK and Swiss individuals, about data received in reliance on the DPF.

Legal Rights & Agreement Rules · Procedure

An unresolved DPF complaint can go to the International Centre for Dispute Resolution at no cost to you

If you do not receive timely acknowledgment of your DPF Principles-related complaint, or GitHub has not addressed it to your satisfaction, the Statement directs you to a linked page to file a complaint. It says the services of the International Centre for Dispute Resolution are provided at no cost to you.

Supporting quotations

If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit

The services of the International Centre for Dispute Resolution are provided at no cost to you.

Qualifications & exceptions

• Applies if GitHub does not acknowledge the complaint in time or does not address it to your satisfaction.

Not stated here

• The linked complaint page is not supplied; "timely" is not defined.

Legal Rights & Agreement Rules · User right or choice

Under certain conditions you can invoke binding arbitration for DPF complaints not resolved elsewhere

The Statement says an individual has the possibility, under certain conditions, to invoke binding arbitration for complaints about DPF compliance that were not resolved by any of the other DPF mechanisms. It points to a linked Data Privacy Framework page for further information; the conditions are not stated in the Statement.

Supporting quotations

An individual has the possibility, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms.

Qualifications & exceptions

• Only under certain conditions, and for complaints not resolved by other DPF mechanisms.

Not stated here

• The conditions for binding arbitration are on a linked page that is not supplied.

Legal Rights & Agreement Rules · Context

GitHub says it is subject to Federal Trade Commission enforcement of its DPF commitments

GitHub states it is subject to the investigatory and enforcement powers of the Federal Trade Commission. Under Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45), failing to abide by commitments to implement the DPF Principles may be challenged as deceptive by the FTC, which can prohibit such misrepresentations through administrative orders or by seeking court orders. This describes the FTC's stated powers; the Act itself is not supplied.

Supporting quotations

GitHub is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC). Under Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45), an organization's failure to abide by commitments to implement the DPF Principles may be challenged as deceptive by the FTC. The FTC has the power to prohibit such misrepresentations through administrative orders or by seeking court orders.

Not stated here

• The text of the cited Federal Trade Commission Act provision is not part of this source.

Legal Rights & Agreement Rules · Company commitment

GitHub may revise the Statement and gives at least 30 days' notice of material changes by website update or email

GitHub may periodically revise the Privacy Statement. If there are material changes, it says it will provide at least 30 days' prior notice by updating its website or by sending an email to the primary email address associated with your GitHub account. Notice by website update does not itself say how you would be alerted.

Supporting quotations

GitHub may periodically revise this Privacy Statement. If there are material changes to the statement, we will provide at least 30 days prior notice by updating our website or sending an email to your primary email address associated with your GitHub account.

Qualifications & exceptions

• The 30-day notice applies to material changes only, and the notice may be given by website update or by email.

Legal Rights & Agreement Rules · Restriction or exception

English controls if a translation conflicts with it; a French PDF and other translations are linked

Translations of the Statement are provided in other languages. In the event of any conflict, uncertainty or apparent inconsistency between a translation and the English version, the English version controls. A French version is available as a PDF, and other languages can be reached from the GitHub documentation site via a language drop-down.

Supporting quotations

Below are translations of this document into other languages. In the event of any conflict, uncertainty, or apparent inconsistency between any of those versions and the English version, this English version is the controlling version.

Cliquez ici pour obtenir la version française

For translations of this statement into other languages, please visit

Qualifications & exceptions

• English controls over any translation.

Not stated here

• The translated versions are not part of this source.

Legal Rights & Agreement Rules · Context

The US state section gives extra information for residents of certain states with distinct privacy laws

This section provides extra information specifically for residents of certain US states that have distinct data privacy laws and regulations. The Statement says these laws may grant specific rights to residents of those states when the laws come into effect. In this section, "personal information" has the same meaning as "Personal Data". The section does not list the states in this introduction.

Supporting quotations

This section provides extra information specifically for residents of certain US states that have distinct data privacy laws and regulations. These laws may grant specific rights to residents of these states when the laws come into effect. This section uses the term “personal information” as an equivalent to the term “Personal Data.”

Qualifications & exceptions

• Applies to residents of certain US states with distinct privacy laws; rights depend on when those laws come into effect.

Not stated here

• The introduction does not list which states are covered; later subsections name California, Colorado, Connecticut, Virginia and Nevada.