SendGrid: DPA, subprocessors and data location
Where to find the SendGrid DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: transactional email delivery. The table is the short version; the sections below add detail.
SendGrid at a glance
| DPA and how it is accepted | |
|---|---|
| Subprocessor list | |
| Notice of new subprocessors | |
| Objection window and remedy | Not stated in the source we checked (2026-10-16). |
| Data regions |
You can choose the region. |
| Transfer mechanism |
|
| Vendor role | Both: processor for some data, controller for other data. Details on its role |
| Checked on | (the oldest check date of any fact on this page) |
Notes on SendGrid
SendGrid's DPA is Twilio's Data Protection Addendum, which covers SendGrid among other Twilio services. Twilio's Binding Corporate Rules do not apply to SendGrid, so the DPF, SCCs and UK IDTA are the transfer mechanisms in the addendum.
Twilio gives written notice at least 10 days for non-infrastructure sub-processors and at least 30 days for infrastructure providers, and you can object during that same notice period (sections 6.2 and 6.3). Subscribing on the sub-processor page adds early details of each change.
EU data residency is opt-in: you create an EU regional subuser and send through api.eu.sendgrid.com. Twilio's docs list Frankfurt, Dublin and Amsterdam. EU subusers cannot use Marketing, Activity, Validation or Geostats, and Marketing Campaigns are not supported.
SendGrid DPA: where to find it and how it is accepted
Read the DPA on www.twilio.com. Forms part of the agreement between you and Twilio covering the Services; the SCCs are deemed signed by entering the Agreement (Schedule 3). Last updated April 9, 2026..
Source: www.twilio.com, checked 2026-10-16Not stated in the source we checked (2026-10-16).
The addendum is Twilio-wide and names the "Twilio SendGrid" services in its termination clause (6.2). It states no plan limits.
Source: www.twilio.com, checked 2026-10-16SendGrid subprocessors: the list and how change notices reach you
Source: www.twilio.com, checked 2026-10-16How changes are announced: Written notice (DPA section 6.2); subscribing on the Twilio sub-processor page adds early details.
Source: www.twilio.com, checked 2026-10-17Notice before a new subprocessor starts: 10 days.
Section 6.2: Twilio gives written notice not less than ten (10) days before a change in sub-processors that are not infrastructure providers, and not less than thirty (30) days before a change in infrastructure providers. Subscribing on the sub-processor page additionally gets you details of any change as soon as reasonably practicable. The figure shown is the shorter period.
Source: www.twilio.com, checked 2026-10-17If no resolution is reached within the notice period, you may discontinue the affected Services by written notice; fees already incurred still apply. No objection by the end of the period means you are deemed to authorize the change (section 6.3).
Source: www.twilio.com, checked 2026-10-16Where SendGrid stores data
- Global setup by default (Twilio's list shows USA, North America and EU sites for SendGrid email)
- EU data residency: Frankfurt, Dublin, Amsterdam
You can choose the region.
EU data residency is opt-in: you create an EU regional subuser with an EU dedicated IP and send through api.eu.sendgrid.com. EU subusers cannot use Marketing, Activity, Validation or Geostats, Marketing Campaigns are not supported, and some retrieval and support processing can leave the EU. Sending through a global subuser sends data outside the EU.
Source: www.twilio.com, checked 2026-10-16How SendGrid moves data outside the EU and UK
- DPF
- SCCs (Modules 1, 2 and 3)
- UK International Data Transfer Agreement
Schedule 3 section 2.1 order of precedence: DPF, then BCRs, then SCCs, then the UK IDTA. The BCRs do not apply to SendGrid Services, which are excluded from "BCR Services".
Source: www.twilio.com, checked 2026-10-16EU-U.S. Data Privacy Framework list: listed.
Listed on the Data Privacy Framework participant list as "Twilio Inc.": EU-U.S. DPF, UK Extension and Swiss-U.S. DPF all shown as Active. The addendum (Schedule 3 section 2.2) says Twilio Inc. participates through self-certification. Read from the list's own participant data on 2026-10-17.
Source: www.dataprivacyframework.gov, checked 2026-10-17Is SendGrid a processor or a controller?
Both: processor for some data, controller for other data.
Section 2: Twilio is a processor or sub-processor, except where it processes Customer Personal Data as a controller under section 3.
Source: www.twilio.com, checked 2026-10-16Is SendGrid GDPR compliant?
We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what SendGrid's own documents say:
- A DPA is published: Forms part of the agreement between you and Twilio covering the Services; the SCCs are deemed signed by entering the Agreement (Schedule 3). Last updated April 9, 2026.
- A subprocessor list is published.
- Notice of new subprocessors: 10 days. Section 6.2: Twilio gives written notice not less than ten (10) days before a change in sub-processors that are not infrastructure providers, and not less than thirty (30) days before a change in infrastructure providers. Subscribing on the sub-processor page additionally gets you details of any change as soon as reasonably practicable. The figure shown is the shorter period.
- Transfer mechanisms named: DPF, SCCs (Modules 1, 2 and 3), UK International Data Transfer Agreement.
- Data locations named: Global setup by default (Twilio's list shows USA, North America and EU sites for SendGrid email), EU data residency: Frankfurt, Dublin, Amsterdam.
What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.
Add SendGrid to your own subprocessor list
This row uses the facts above. Change the purpose to match how you use SendGrid, then paste it into your list, or open it in the generator to add your other vendors.
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
|---|---|---|---|---|---|
| SendGrid | Transactional email delivery | Global setup by default (Twilio's list shows USA, North America and EU sites for SendGrid email); EU data residency: Frankfurt, Dublin, Amsterdam | DPF; SCCs (Modules 1, 2 and 3); UK International Data Transfer Agreement | DPA | List |
Same row as Markdown
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| SendGrid | Transactional email delivery | Global setup by default (Twilio's list shows USA, North America and EU sites for SendGrid email); EU data residency: Frankfurt, Dublin, Amsterdam | DPF; SCCs (Modules 1, 2 and 3); UK International Data Transfer Agreement | [DPA](https://www.twilio.com/en-us/legal/data-protection-addendum) | [Subprocessors](https://www.twilio.com/legal/sub-processors) |
If you add or replace SendGrid: what to tell your customers
Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.
SendGrid states 10 days of notice before it adds a subprocessor. Section 6.2: Twilio gives written notice not less than ten (10) days before a change in sub-processors that are not infrastructure providers, and not less than thirty (30) days before a change in infrastructure providers. Subscribing on the sub-processor page additionally gets you details of any change as soon as reasonably practicable. The figure shown is the shorter period. If your own customers were promised a longer notice, you have a gap to plan for.
Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.
What changed
- Re-checked sections 6.2, 6.3 and Schedule 3 against the full DPA text. Corrected the notice note: the 10 and 30-day written notice does not depend on subscribing.
- Checked the Data Privacy Framework list: "Twilio Inc." is listed (EU-U.S. DPF, UK Extension and Swiss-U.S. DPF all shown as Active). dpf_listed set to true.
- First check: facts recorded from Twilio's Data Protection Addendum (April 9, 2026), sub-processor list and SendGrid EU data residency docs.
Related vendors
Sources and method
- https://www.twilio.com/en-us/legal/data-protection-addendum checked 2026-10-16
- https://www.twilio.com/en-us/legal/sub-processors checked 2026-10-16
- https://www.twilio.com/docs/sendgrid/data-residency/locations-eu checked 2026-10-16
- https://www.dataprivacyframework.gov/participant/5394 checked 2026-10-17
Facts come from SendGrid's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: sendgrid.com.