Data protection and privacy

We believe our customers should have choices regarding their data and we are committed to being transparent about what data we collect, and how it’s used, shared and stored.

We follow Privacy by Design principles that govern the treatment of data owned by, or under the control of, Autodesk. These are applied worldwide and reflected across the company in development plans, business plans, and day-to-day operations.

We follow Autodesk’s Privacy Principles and perform privacy impact assessments where personal data is collected or used. We also provide general and role-specific privacy training to our workforce.

All of our employees, contingent workers, and subsidiaries are required to abide by our Privacy Statement and to adhere to internal policies, standards, and guidelines regarding Autodesk’s overall data protection requirements and Privacy Principles:

• Be transparent about our actions and intent
• Present individuals with clear and actionable choices
• Practice purposeful collection, use, and retention of data
• Use data for the purposes for which it was collected
• Only share data with third parties in limited and approved ways
• Be accountable for enforcement of these Privacy Principles

We are a member of the BSA | The Software Alliance and Information Technology Industry Council (ITIC) and support their work advocating for public policies that improve privacy protections.

BCRs are legally binding and enforceable internal rules and policies for data transfers within multinational group companies and work like an internal code of conduct. They enable companies to transfer personal data internationally to countries that do not provide an adequate level of protection for personal data as required under the GDPR. Autodesk received approval from the Irish Data Protection Commission in May 2023.

Autodesk Controller BCR Policy

Autodesk Processor BCR Policy

BCR Frequently Asked Questions

The Autodesk Privacy Statement explains how we handle personal data, how such data can be accessed and updated, and how we protect this data when interacting with third parties.

The Cookie Statement describes the way we use cookies, tags, and pixels in our applications. It contains a link to a tool for users to set their cookie preferences. 

The Children’s Privacy Statement addresses how we collect, process, store, and delete children’s personal data.

The Candidate Privacy Statement describes how we collect, process, store, and delete personal data about job applicants and prospective candidates.

We provide a link to other important legal documents that may help you fully understand our services and rights, including our General Terms, Special Terms, Subscription Benefits, and Subscription Types.

Additionally, Autodesk offers a Data Processing Addendum (DPA), which sets forth Autodesk’s obligations where it is a processor for personal data under the GDPR.

We are committed to strong privacy and security protections for customer data that is entrusted to us.

Autodesk will continue to use Standard Contractual Clauses (SCCs), which remain valid under the recent Schrems II decision by the European Court of Justice, as a legal mechanism for transferring personal data of its customers from the EEA to the U.S. or other applicable jurisdictions. We have recently revised our Data Processing Agreement (DPA) with the new EU Standard Contractual Clauses.

We also offer on request to customers ‘Supplementary Measures’ – these are technical and operational measures (including encryption and review of government requests for access to data) to provide data protection controls for our data transfers from the EU.

Autodesk has also adopted Binding Corporate Rules (BRCs) for controller and processor data transfers that have been approved by the Irish Data Protection Commission.

Autodesk has self-certified and we are officially part of the new Data Privacy Framework. The EU-U.S. DPF, UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF were respectively developed by the U.S. Department of Commerce and the European Commission, UK Government, and Swiss Federal Administration to provide U.S. organizations with reliable mechanisms for personal data transfers to the United States from the European Union, United Kingdom, and Switzerland while ensuring data protection that is consistent with EU, UK, and Swiss law.

Autodesk has compiled a whitepaper (Data Transfer Whitepaper) documenting how it complies with EU data transfer requirements.

Autodesk’s Transparency Report explains Autodesk’s policy on responding to requests for customer data by government agencies for law enforcement purposes. The report also provides statistics on the types of requests Autodesk receives and how Autodesk responds to these requests. Previous transparency reports are available below.