![GoDaddy's own trust-centre illustration - an eye set in a sculpted arch - representing the data-protection terms this page reads]()
If you run a website, store or mailbox on GoDaddy and anyone else's personal data passes through it, there is a contract you never signed that says who is responsible for that data. It is the Data Processing Addendum, it takes effect automatically with your agreement, and it is a different document from the privacy policy.
We read it in full on 23 October 2026 from GoDaddy's India site. Three things stand out: it never mentions India or the DPDP Act, it states that nothing in it gives you a right to audit GoDaddy, and it makes thirty days of your silence into acceptance of a new subprocessor.
📅 Update log:
23 Oct 2026: first published. Full text of GoDaddy's Data Processing Addendum read at godaddy.com/en-in/legal/agreements/data-processing-addendum on 23 October 2026, from India, logged out. Word searches for "India" and "DPDP" returned zero matches on that date. The document carries no revision date we could read, so this page is dated to our reading. Nothing was purchased and GoDaddy was not contacted.
What this document is, and why it is not the privacy policy
GoDaddy publishes two quite different data documents. The privacy policy covers what GoDaddy does with your data as its customer. The Data Processing Addendum, which is this one, covers what happens to your customers' data - the personal data of the people who use the site, store or mailbox you run on GoDaddy's infrastructure.
If you run a business on GoDaddy and anyone else's personal data passes through it, this is the document that allocates the duties. It applies automatically: it "is effective as of the effective date of the Agreement" and "governs all Processing of Customer Personal Data" - you do not sign it separately.
We read it in full on 23 October 2026, from the India version of GoDaddy's own site. Everything below is quoted or summarised from that text.
Who is who, in the document's own terms
| Party | Role under the DPA | What that means in practice |
|---|
| GoDaddy | Processor | Processes your customers' data on your documented instructions only |
| You, the customer | Controller (or processor) | Decide the purposes and means; solely responsible for the accuracy, quality and legality of the data and how you got it |
| Your website's visitors | Data Subjects | Their requests come to you, not to GoDaddy |
| Subprocessors | Anyone GoDaddy contracts to process the data | You give general authorisation up front; GoDaddy stays liable for their acts and omissions |
The split matters most at one point: because you are the controller and GoDaddy is the processor, requests from your users go to you. GoDaddy "will not respond to a Data Subject Request except on documented instructions from Customer or as otherwise required under applicable law".
The India question: which law is this written for?
This is the finding an Indian reader should take away first. The DPA served on GoDaddy's en-in site mentions "India" zero times and the Digital Personal Data Protection Act zero times, on a word search of the full text on 23 October 2026.
The legal machinery it does set out is European and British. It deems the EU Standard Contractual Clauses and the UK International Data Transfer Agreement to be executed between the parties; it names GoDaddy's self-certification under the EU-US, Swiss-US and UK-US Data Privacy Framework; and it names three supervisory authorities - the North Rhine-Westphalia State Commissioner for EU/EEA transfers, the Swiss Federal Data Protection and Information Commissioner, and the UK Information Commissioner. The Standard Contractual Clauses themselves are "governed by the internal laws of Germany".
We want to be fair about what this does and does not mean. The SCC and UK IDTA apparatus is EU and UK-specific by construction - there is no Indian equivalent instrument to deem executed, so its absence is not evidence of anything. And the DPA's substantive obligations are written against "applicable Data Protection Laws", defined as "any law or regulation applicable to processing", which on its face would pick up Indian law where Indian law applies.
The practical point is narrower and still worth knowing: if you are an Indian business looking for DPDP-specific commitments, named obligations or an Indian grievance route in this document, they are not in it. Take your own advice rather than assuming the European clauses carry across to your position.
Every deadline in the document, in one table
| Period | What it governs | The catch |
|---|
| 60 days | Advance notice before a new subprocessor is appointed | "reasonable efforts"; not required if immediate appointment is needed for security or law |
| 30 days | Your window to object to a new subprocessor | Silence is acceptance — no objection means "deemed to have accepted" |
| 30 days | To resolve an objection before you may terminate | GoDaddy uses "commercially reasonable efforts" at its sole discretion |
| 3 business days | GoDaddy stops processing and tells you if your instruction appears unlawful | One of the few hard deadlines on GoDaddy in the document |
| 45 days | To answer a compliance-information request | If it does not, you may terminate the Agreement |
| No fixed period | Security incident notification | "commercially reasonable efforts… within the time period required under applicable law" |
Read the 30-day subprocessor window carefully. It is the only clock in this document that runs against you by default - silence is acceptance - and the notice that starts it can be, in the DPA's own words, GoDaddy "updating the Subprocessor list". If subprocessor changes matter to your compliance position, checking that page is a task somebody has to own.
What the DPA puts on you, not on GoDaddy
| Obligation | What the DPA says |
|---|
| Backups | "GoDaddy is not responsible for backing up Customer Personal Data." |
| Data subject requests | You are "solely responsible for responding to any request to exercise a Data Subject's rights" — access, correction, deletion. GoDaddy will not respond to one except on your documented instructions. |
| Deciding which laws apply to you | "GoDaddy is not responsible for determining which laws or regulations are applicable to Customer's business." |
| If the service is not compliant for your use | "Customer's sole remedy… is termination of any portion of the Agreement that relates to processing." GoDaddy is "not required to undertake any steps to alter or make GoDaddy's Services compliant for Customer's specific use". |
| Consent and disclosure on your own site | You must "use commercially reasonable efforts to disclose clearly, and obtain consent to, any data collection, sharing and usage", and make clear that end-user data may be processed outside their country of origin. |
| Card data | You must comply with PCI-DSS, and may only send payment-card data to GoDaddy services specifically designed to process it — you are "solely responsible for any violation" if you do otherwise. |
| Vulnerabilities in your own content | You are "solely responsible for ensuring that all content" you place in the Services is free of vulnerabilities, including malware. |
What GoDaddy does commit to
- Process only on your documented instructions, for the limited purposes in the Agreement - and not to sell your customers' personal data to any third party.
- Not to combine Customer Personal Data with other data it collects, except as the Agreement expressly permits.
- Stop processing and notify you within three business days if it believes your instruction breaks data protection law, or that it cannot comply.
- Refuse informal requests for your customers' data. It "will not respond to any informal request… from a government body, law enforcement agency, or other person except in response to a subpoena, search warrant, court order, or other similar legal process" - with exceptions where disclosure is required by law or needed to prevent harm.
- Tell you when legal process arrives, unless prohibited, and cooperate with your efforts to resist disclosure - though at your reasonable expense.
- Stay liable for its subprocessors, including their subprocessors, and vet them before any transfer under a written agreement "at least as protective" as the DPA.
- Return, delete or de-identify the data after termination, unless law requires retention - and delete it promptly once that requirement lapses.
If you take four things from this page
- Back up your own data. The DPA says plainly that GoDaddy is not responsible for backing up Customer Personal Data. That is a sentence with real operational consequences - and GoDaddy sells a separate paid backup product with its own limits.
- Own your users' rights requests. Access, correction and deletion requests from your site's visitors are yours to answer, and GoDaddy will not answer them for you.
- Decide who watches the subprocessor list. Thirty days of silence is acceptance, and the notice may be nothing more than that page changing.
- Notice what your remedies actually are. No audit right; a 45-day information clock; and in three separate places - an unresolved subprocessor objection, a non-response to an information request, and services that do not suit your legal position - the stated remedy is termination.
What this page does not tell you
This is a reading of a published document, not legal advice. Every quotation and figure on this page comes from GoDaddy's own Data Processing Addendum at godaddy.com/en-in/legal/agreements/data-processing-addendum, fetched on 23 October 2026 from India as a logged-out visitor. Nothing was purchased, no account was opened and GoDaddy was not contacted. We are not lawyers and this page is not a compliance opinion - if your business processes personal data on GoDaddy infrastructure, take your own advice on your own facts.
We cannot tell you how any of it works in practice. We have not requested compliance information, objected to a subprocessor, filed a data subject request or been through a security incident. How GoDaddy actually behaves on a 45-day information request or a breach notification is not something a contract can tell you, and we make no claim about it.
Nothing here says GoDaddy's terms are improper or unusual. No audit right, general subprocessor authorisation with an opt-out window, and customer-side responsibility for data subject requests are all common in processor agreements at this scale, and several of the commitments above - the 60-day notice, liability for subprocessors, refusing informal law-enforcement requests - are more protective than they need to be. Our purpose is to say what the document contains, including the parts a reader would not guess.
And the document carries no revision date we could read, so we date this page to our own reading rather than claiming a version. GoDaddy can change these terms; check the live document before relying on anything here.
Frequently Asked Questions
Does GoDaddy's Data Processing Addendum cover India's DPDP Act?
The document does not mention India or the DPDP Act at all. Read on 23 October 2026 from the en-in version of GoDaddy's own site, the DPA contains zero occurrences of "India" or "DPDP". What it does name is the European machinery: the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, and the EU-US, Swiss-US and UK-US Data Privacy Framework, with the North Rhine-Westphalia State Commissioner, the Swiss FDPIC and the UK Information Commissioner named as supervisory authorities. The Standard Contractual Clauses are governed by "the internal laws of Germany". This is not in itself a failing - that machinery is EU and UK-specific by design, and the DPA's operative obligations are written against "applicable Data Protection Laws" generally, which would include Indian law where it applies. But if you are an Indian business expecting DPDP-specific commitments by name, they are not in this document, and you should take your own advice rather than assume the EU clauses carry across.
Can I audit GoDaddy under its DPA?
No. The DPA says so in terms. "For the avoidance of doubt, nothing in this DPA gives Customer the right to conduct an audit of GoDaddy's business, systems, or services." What you get instead is an information right: you "may periodically request information reasonably necessary to confirm GoDaddy's compliance with its obligations under applicable Data Protection Laws", and GoDaddy's duty is limited to providing that information. There is one piece of leverage attached: if GoDaddy fails to respond within 45 days, you may terminate the Agreement. That is the pattern throughout this document - where you have a remedy, the remedy is usually to leave.
What happens when GoDaddy adds a new subprocessor?
You are deemed to accept it unless you object within 30 days. You give "general authorization" for subprocessors when you sign. After that, GoDaddy "will exercise reasonable efforts to notify Customer in writing at least sixty (60) days in advance" - though that notice is not required if immediate appointment is needed to maintain security or comply with law. Two details matter. First, "Notice of a new Subprocessor may be provided by updating the Subprocessor list" - so the notice can be a webpage changing, which means watching it is on you. Second, "If Customer does not object to a new Subprocessor within thirty (30) days… Customer will be deemed to have accepted". If you do object and it is not resolved in 30 days, your remedy is to terminate. On the other side of the ledger, GoDaddy is expressly liable for its subprocessors' acts and omissions, including their own subprocessors'.
How quickly must GoDaddy tell me about a data breach?
The DPA sets no fixed number of hours or days. It says GoDaddy "will use commercially reasonable efforts to notify Customer of a breach of security of GoDaddy's systems… within the time period required under applicable law" - so the clock is whatever your law imposes, not a commitment the contract adds on top. Three related terms are worth reading together. GoDaddy is "not responsible for" incidents that do not result from a compromise of its own systems - it names weak passwords and downloaded malicious content as examples. An acknowledgement or a decision to notify "is not an admission of fault or liability". And on penalties, "neither Party will be responsible for any fines issued or levied by any regulatory authority… on the other Party", GDPR Article 83 fines included.
What does GoDaddy's DPA make me responsible for?
More than most customers assume - starting with backups. "GoDaddy is not responsible for backing up Customer Personal Data." You are also "solely responsible for responding to any request to exercise a Data Subject's rights" - every access, correction and deletion request from your own users lands with you, and GoDaddy will not answer one except on your documented instructions. You are solely responsible for the accuracy, quality and legality of the data and how you obtained it, for obtaining consent on your own site, for telling users their data may be processed outside their country, for PCI-DSS compliance on any card data, and for keeping your own content free of vulnerabilities. GoDaddy is also "not responsible for determining which laws or regulations are applicable to Customer's business" - and if its services turn out not to suit your legal position, your sole remedy is to terminate.
Prices & codes last verified: October 23, 2026
Every quotation, figure and clause reference on this page was read from GoDaddy's own published Data Processing Addendum at godaddy.com/en-in/legal/agreements/data-processing-addendum on 23 October 2026, from India, as a logged-out visitor. Nothing was purchased, no account was opened and GoDaddy was not contacted. This page is a reading of a published contract and is not legal advice, not a compliance opinion and not a substitute for your own counsel; we are not lawyers, and whether any clause here helps or binds your business depends on facts we do not have. The statement that the document does not mention India or the DPDP Act is the result of a word search of the full text on the date above and is not a claim that Indian law does not apply - the DPA's obligations run against "applicable Data Protection Laws" generally. Nothing here asserts that GoDaddy's terms are improper, unusual or non-compliant: no audit right, general subprocessor authorisation and customer-side responsibility for data subject requests are common in processor agreements of this kind. We have not requested compliance information, objected to a subprocessor, filed a data subject request or experienced a security incident, so nothing here describes how these terms operate in practice. The document carries no revision date we could read, so this page is dated to our reading rather than to a version. Terms can change without notice - read the live document before relying on it. Zoutons may earn a commission on purchases made through links on this page, which never affects what we report.
Booking com 
Hostinger 
Dell 
Udemy 
Agoda 
Nykaa 
Myntra 
Ajio