Skip to content

California Privacy Notice

Original document

LAST VERIFIED 2026-10-01

Attention points

15 TO CHECK

Pointers to disclosures this policy may not clearly make, checked against major privacy laws. This is a heuristic — not legal advice, and not a finding that anything is missing or unlawful.

GDPR / UK-GDPR

1/13 ADDRESSED
  • Who controls your data (identity & contact of the data controller)GDPR Art. 13(1)(a)
  • Data Protection Officer contactGDPR Art. 13(1)(b)
  • The legal basis for using your dataGDPR Art. 13(1)(c)
  • Legitimate interests relied on (where that is the basis)GDPR Art. 13(1)(d)
  • International transfers and their safeguardsGDPR Art. 13(1)(f) / 46
  • How long your data is kept (retention)GDPR Art. 13(2)(a)
  • Your data-subject rights (access, erasure, portability, object, …)GDPR Arts. 13(2)(b), 15–21
  • The right to withdraw consent (where consent is the basis)GDPR Art. 13(2)(c)
  • The right to complain to a supervisory authority (e.g. the ICO)GDPR Art. 13(2)(d)
  • Whether providing your data is required, and what happens if you don'tGDPR Art. 13(2)(e)
  • Automated decision-making or profilingGDPR Arts. 13(2)(f), 22
  • Where your data was obtained, if not collected from you (source)GDPR Art. 14(2)(f)

CCPA / CPRA

7/10 ADDRESSED
  • A 'Limit the Use of My Sensitive Personal Information' option (CPRA)CPRA §1798.135(a)
  • A non-discrimination promise for exercising your rightsCCPA §1798.125
  • Retention period (or criteria) per category of data (CPRA)CPRA §1798.100(a)(3)

Current text

Last Updated 20 September 2023 This California Privacy Notice ("CA Privacy Notice") contains disclosures required by the California Consumer Privacy Act ("CCPA") and applies only to California residents. This Privacy Notice describes Instructure's collection, use, and disclosure of personal information as defined in the CCPA, as well as your rights with respect to that personal information. It applies when Instructure is acting as a "business" as defined by the CCPA, for…

Show full text