Retool's DPA now makes you check that your use of Retool meets privacy law

The change

Retool rewrote its Data Processing Addendum, the contract that sets out how Retool handles the personal data its customers put into the platform. The page now shows "Last updated on Aug 12, 2026" and says it is "Applicable to customers on any plan." Retool is a platform for building internal tools, so the data in it is often employee, customer, and business data pulled from a company's own databases.

One new sentence in the section on customer obligations stands out:

"Customer is responsible for independently determining whether its use of the Retool Platform will meet its requirements and legal obligations under Data Protection Laws."

The rewrite also removes a sentence about monitoring security, changes the list of sensitive data customers may submit, and changes how the DPA takes effect.

What changed

• Your own legal check. The customer is now responsible for "independently determining" whether its use of Retool meets its obligations under data protection laws.

• Security monitoring sentence removed. The old DPA said "Retool regularly monitors compliance with these measures." The new one does not.

• Health data off the list. The list of special categories of data customers may submit no longer includes "genetic or biometric data" or "health," and is now "Subject to the "HIPAA Compliance" section of the Agreement."

• No pre-signed form. The old DPA was "pre-signed on behalf of Retool" and became binding when Retool received the completed form. The new one no longer describes that signing step.

• New California privacy commitments. For data covered by the California Consumer Privacy Act (CCPA), Retool now says it will not "sell" or "share" it, combine it with data from other sources except as the law allows, or use it outside its business relationship with the customer.

• More details to object. An objection to a new sub-processor must now include a copy of the current Order Form or, on non-enterprise plans, the account name.

• Deletion tied to the whole agreement. Return or deletion of personal data on request now applies "Upon termination of the Agreement," instead of on termination of the services that processed the data.

Checking your own compliance

The old DPA already made customers responsible for "the accuracy, quality, and legality of Relevant Personal Data and the means by which Customer acquired" it. That part stays. The old DPA's transfer terms also had the customer make "an independent determination as to whether the technical and organisational measures set forth in the Security Practices Page meet Customer's requirements." That clause is gone, and the new sentence applies the same idea more broadly. It puts on the customer the job of deciding whether using Retool at all fits its own legal obligations under data protection laws, which the DPA defines to include the GDPR, UK and Swiss law, and US state privacy laws such as the CCPA.

The DPA still lists what Retool commits to: it processes personal data only for the purposes in the agreement, follows the customer's instructions, helps with data subject requests and impact assessments, and notifies the customer of breaches. Read together, this suggests those commitments are not a statement from Retool that a particular customer's use is compliant.

The security section gets shorter

The security section in the old DPA had three sentences. Retool would maintain appropriate technical and organisational measures "as set forth in the Security Practices Page." Then: "Retool regularly monitors compliance with these measures." Then: "Retool will not materially decrease the overall security of the Services during a subscription term."

The new section keeps the first and the last, with "Services" replaced by "Retool Platform." The middle sentence is gone. The DPA does not say why, and it does not replace the sentence with another monitoring commitment.

Health data and HIPAA

Schedule 1 of the DPA lists the special categories of personal data a customer may submit. The old list was: "racial or ethnic origin; political opinions; religious or philosophical beliefs; trade-union membership; genetic or biometric data; health; and sex life." The new list stops at "trade-union membership; and sex life," and the paragraph now opens with "Subject to the "HIPAA Compliance" section of the Agreement."

That section of Retool's Master Subscription Agreement says Retool "is not a Business Associate or subcontractor" under HIPAA and that "Customer should not submit, collect or use any "protected health information," as defined in 45 CFR §160.103, to the Retool Cloud Platform." For teams that build tools on patient or health data in Retool Cloud, the DPA no longer lists health as a category they may submit.

How the DPA takes effect

The old DPA described itself as "pre-signed on behalf of Retool" and said it "becomes legally binding upon receipt by Retool of the validly completed DPA." The page offered a PDF download and a link to sign it. The old DPA also said it was "supplemental to, and forms part of" the customer's agreement, and the new one keeps that idea: it "supplements and forms part of the Customer Terms of Service, the Master Subscription Agreement, or other written agreement between Retool and Customer." What is gone is the pre-signed form, the signing link, and the sentence about becoming binding on receipt.

For customers on the Master Subscription Agreement, the version that applies depends on timing. The agreement incorporates "the terms of the data processing addendum at https://docs.retool.com/legal/dpa ("DPA") posted as of the Effective Date." A customer whose agreement started before the rewrite may still be covered by the earlier text.

Smaller edits

Breach notice changed from "without undue delay" to "without undue delay or within the period required under Data Protection Law." Retool now commits to "treat Relevant Personal Data as Customer's Confidential Information under the Agreement." The DPA's own governing law clause, which named California and the courts of San Francisco County, now points to "the governing law and jurisdiction provisions in the Agreement, unless required otherwise by Data Protection Laws." The examples of personal data in Schedule 1, such as "a CRM object pulled from a Database" and "HRIS information about employees," were removed.

What did not change

Customers still have ten business days to object to a new sub-processor after a notification, and if Retool cannot offer a workaround within 30 days, either side can terminate the affected part of the order and Retool refunds prepaid fees for it. Retool remains liable for its sub-processors as if it performed their work itself. The audit rights, including on-site audits at the customer's cost where data protection laws require them, are the same. Liability under the DPA and the agreement was already counted together across the customer and its affiliates, and the Standard Contractual Clauses for transfers from Europe are still governed by Irish law.

Why this matters

A DPA is one of the few vendor documents that security reviews and customer questionnaires actually ask for. Teams often file it once and quote it for years. Each of these edits changes something a team might have quoted: a monitoring statement, a list of data types, a signing process.

Retool is not the only vendor rewriting its DPA this year. Hotjar's DPA can now change without your signature, and Klaviyo no longer promises to pass privacy requests on to you. Keeping track of these documents is part of vendor contract monitoring, alongside the order forms and master agreements they attach to.

Potential impact

The update raises five practical questions:

• Which version of the DPA applies to you, given the date your agreement with Retool started?

• Do your security questionnaires or vendor records quote Retool's old statement that it "regularly monitors compliance" with its security measures?

• Do any of your Retool apps handle health, genetic, or biometric data?

• Have you documented your own assessment of whether your use of Retool meets your privacy obligations?

• If you plan to object to a new sub-processor, do you know where your current Order Form or account name is?

How Venpo detected it

Venpo monitors Retool's legal pages, including the Data Processing Addendum, the Master Subscription Agreement, the sub-processor list, and the security practices page, and keeps each version it reads. Comparing the earlier DPA with the current one clause by clause showed which commitments were added, which were removed, and which stayed the same. Every quote from the current DPA was checked against the live page.

Business outcome

Teams that track Retool's documents have the old and new DPA side by side: the removed monitoring sentence, the shorter list of special categories, the new CCPA commitments, and the new requirement to assess their own compliance. That is what a security or privacy team needs to update vendor records and answer customer questionnaires accurately.

Key takeaway

Retool's rewritten DPA asks customers to decide for themselves whether their use of Retool meets data protection law, no longer says Retool regularly monitors its security measures, and drops health data from the categories customers may submit, while adding CCPA commitments and dropping the pre-signed form. These are the kinds of changes you only catch when you monitor vendor terms of service and DPAs over time.