At Cisco, we empower our customers to control their data. Protecting the privacy, integrity, and confidentiality of data in our possession is of utmost importance. In a world of advancing cyberthreats, expanding extraterritorial legislation, and growing concerns for data localization, we understand technology companies have an outsized responsibility to ensure customers have the power to make important decisions about their data.

Like all global technology companies, there are scenarios when Cisco receives demands from law enforcement, intelligence agencies, or governments requesting access to data related to an ongoing investigation. When this happens, Cisco follows a strict set of procedures to ensure that data disclosures are minimized, controlled, and that access to our solutions and services remains free from unlawful intrusion.

Our Principled Approach drives our policies and procedures in how we operate as a company when receiving government demands for data: 

Principle 1: We believe governments, including law enforcement and national security agencies, should go directly to our customers to gain access to data regarding those entities, their employees, and users. We will refer government to the relevant customer before disclosing any data in Cisco’s possession. We will only consider disclosing data directly to the government in scenarios where the customer does not have the relevant corresponding data, if the customer has requested that we disclose the data to the government, or if the government has confirmed that it cannot seek the requested information from the customer.

Principle 2: Cisco will provide data in response to a demand only if the requesting government has demonstrated appropriate lawful authority to require us to provide the data. Where demands are not accompanied by valid legal process, Cisco will challenge or reject the request. 

Principle 3: Cisco will carefully review every government demand to ensure legal validity, and we will narrowly interpret demands to produce the least data necessary to comply. Cisco will challenge any government demand that raises human rights concerns. Cisco’s actions will be guided by our Global Human Rights Policy.

Principle 4: Unless prohibited by applicable law, Cisco will notify the customer that its data has been requested prior to producing any data to government, so that the customer may attempt to limit or prevent disclosure.

Principle 5: Cisco will only make an exception to our customer notification commitments in emergency circumstances where disclosure to the government will prevent imminent death or serious physical harm to an individual. Where not prohibited by applicable law, we will subsequently notify the customer if such an exception has been made. Emergency demands will be included in our semiannual Transparency Report.

Principle 6: Where demands that prohibit notification to the customer are excessive in duration (over one year in length), or are overly broad in scope, Cisco will challenge the demand to protect our customer’s interests.

Principle 7: Where compliance with a valid government demand would put Cisco in potential breach of applicable data protection and/or privacy related laws in another country that has jurisdiction over the data, we will challenge the demand and invoke mutual legal assistance mechanisms, where appropriate.

We are committed to constantly reassessing these principles to ensure they align with growing international privacy regulations and continuously exceed our customers’ expectations.

Beyond our principles, Cisco actively engages in advocacy work in topics of government surveillance reform and digital sovereignty to help encourage regulations that are consistent with Cisco’s principled approach. We are members of BSA The Software Alliance, Information Technology Industry Council (ITI), and the US ASEAN Business Council to address these issues across the globe.

Have a question about Our Principled Approach or Transparency Reports? Reach out to governmentdatademands@cisco.com or visit our Trust Center