GitLab Privacy

The Privacy Team is part of the Legal and Corporate Affairs Team. We provide support and guidance to uphold consistent business processes around the proteciton of personal data as it relates to GitLab customers, users, Team Members, and other natural persons. We collaborate cross-functionally and serve as advocates to ensure that the data privacy practices of GitLab meet the needs of our cross-functional partners and are continually balanced with an ever-changing global data privacy and protection landscape.

Quick Links

• What is data privacy
• Privacy Terms
• Vendor Privacy Review Process
• Internal Product Feature/Release Privacy Review
• Guidelines for Law Enforcement Requests

Privacy Statement Links

• GitLab Privacy Statement
• GitLab Cookie Policy
• GitLab Team Member Privacy Notice

Contact the Team

Slack channel - #legal is the best place for questions relating to our team that do not require legal advice, deliverables, or any discussion of confidential information.

For issues that require action from the Privacy Team, apply the label Privacy::Intake. This will update the Privacy_Legal Issue Board and allow the team to triage the issue appropriately. We also use the following labels:

• Privacy::In Process - when the Privacy Team is actively working on the issue
• Privacy::Pending Requestor - when the Privacy Team has a requirement or task that must be met by the business owner before the issue progresses
• Privacy::Done - when the Privacy Team has finished their portion of the issue
• Privacy::Attention for awareness only, no action needed.

For sensitive, private, or confidential requests email legal_internal@gitlab.com. Please do not send emails to this address for engineering, marketing, sales or procurement requests. These should be directed to #legal or an issue should be created in the Legal and Compliance project.

What Data Privacy Means

Tell people what you are doing with personal data and why you are doing it so that the person can make an informed decision about whether they want to allow it to happen. Do not be creepy about what personal data is collected or how it is used and do not change the way personal data is used without first giving people notice and an opportunity to object, or, where required, obtaining prior consent. Make it easy for people to tell us their privacy preferences and honor those preferences even if they change over time. Build a product or service that has privacy-focused settings turned on by default and let the consumer decide if and when they want to change that. Transparency is a core value and every team member is responsible for the proper collection and use of personal data consistent with our Privacy Statement.

Privacy Terms

Privacy Review Process

Every vendor that handles personal data is required to go through a Privacy Review prior to being onboarded, which includes completion and approval of the privacy due diligence questionnaires detailed in the Procurement process. Certain vendors who are classified as handling red or orange data under our Data Classification Standards are reviewed annually. Additionally, when new product features are designed, there are times when a formal privacy review is required.

This section outlines the process for these reviews.

Vendor Privacy Review

graph TD
   A[Evaluating Potential<br> New Vendor] --> Did1[(Is there a Zip Request?)]
   B[Pilot with<br> New Vendor] --> Did1[(Is there a Zip Request?)]
   C[Renewing<br> Vendor] --> Did1[(Is there a Zip Request?)]
   Did1 --> E1[Yes]
   Did1 --> E2[No]
   E1 --> F[Privacy Review runs<br> concurrently with <br> Security and Legal in Zip]
   E2 --> G[Is there an existing Issue?]
   G --> H1[Yes]
   G --> H2[No]
   H1 --> I[Add `Privacy::Intake`<br> label to the Issue]
   H2 --> J[Create New Issue]
   F --> K[Privacy Review SLA<br> is 2 weeks]
   I --> K
   J --> K
   K --> L[If DPIA required<br> SLA for DPIA<br> is 4 weeks]
   L --> M[Approved?]
   M --> N1[Yes]
   M --> N2[No]
   N1 --> O[Process Complete<br> Approved]
   N2 --> P[Third-Party Risk<br> Acceptance Required]

   click Did1 "https://handbook.gitlab.com/handbook/business-technology/enterprise-applications/guides/zip-guide/"
   click J "https://gitlab.com/gitlab-com/legal-and-compliance/-/blob/master/.gitlab/issue_templates/Vendor-Procurement-Privacy-Review.md" _blank
   click P "https://gitlab.com/gitlab-com/legal-and-compliance/-/blob/master/.gitlab/issue_templates/Third-Party-Risk-Acceptance.md" _blank

   style A fill:#E6E6FA
   style B fill:#E6E6FA
   style C fill:#E6E6FA
   style Did1 fill:#FF8C00
   style E1 fill:#C0C0C0
   style E2 fill:#C0C0C0
   style F fill:#FF8C00
   style G fill:#FF8C00
   style H1 fill:#C0C0C0
   style H2 fill:#C0C0C0
   style I fill:#98FB98
   style J fill:#98FB98
   style K fill:#ADD8E6
   style L fill:#ADD8E6
   style M fill:#FF8C00
   style N1 fill:#C0C0C0
   style N2 fill:#C0C0C0
   style O fill:#2E8B57
   style P fill:#DC143C

For Third-Party Risk Acceptance, any Moderate/High risk requires VP and/or above approval

Internal Privacy Review

Privacy Training

GitLab Team Members are required to complete annual training which covers general privacy practices worldwide. The goal of annual training is to ensure that Team Members understand what personal data is and how to handle it to ensure that GitLab maintains the trust our customers have placed in us as well as to ensure that GitLab remains compliant with frequently changing legal and regulatory obligations.

View page source - Edit this page - please contribute.