Common use of Measures Clause in Contracts

Measures. SAP has implemented a multi-layered defense strategy as a protection against unauthorized modifications. • In particular, SAP uses the following to implement the control and measure sections described above: • Firewalls; • Security Monitoring Center; • Antivirus software; • Backup and recovery; • External and internal penetration testing; • Regular external audits to prove security measures. Appendix 3 to the DPA and, if applicable, the Standard Contractual Clauses The following table sets out the relevant Articles of GDPR and corresponding terms of the DPA for illustration purposes only.

Measures. SAP has implemented a multi-layered defense strategy as a protection against unauthorized modifications. • In particular, SAP uses the following to implement the control and measure sections described above: • Firewalls; • Security Monitoring Center; • Antivirus software; • Backup and recovery; • External and internal penetration testing; • Regular external audits to prove security measures. Appendix 3 (applies to the DPA andTOMs Set 2 Services defined above) Last Updated: May 4, if applicable, the Standard Contractual Clauses The following table sets out the relevant Articles of GDPR and corresponding terms of the DPA for illustration purposes only.2020

Measures. SAP has implemented a multi-layered defense strategy as a protection against unauthorized modifications. • In particular, SAP uses the following to implement the control and measure sections described above: • Firewalls; • Security Monitoring Center; • Antivirus software; • Backup and recovery; • External and internal penetration testing; • Regular external audits to prove security measures. Appendix 3 to the DPA and, if applicable, the Standard Contractual Clauses The following table sets out the relevant Articles of GDPR and corresponding terms of the DPA for illustration purposes only.

Measures. SAP has implemented a multi-layered defense strategy as a protection against unauthorized modifications. • In particular, SAP uses the following to implement the control and measure sections described above. In particular: • Firewalls; • Security Monitoring Center; • Antivirus software; • Backup and recovery; • External and internal penetration testing; • Regular external audits to prove security measures. Appendix 3 to the DPA and, if applicable, the Standard Contractual Clauses The following table sets out the relevant Articles of GDPR and corresponding terms of the DPA for illustration purposes only.

Measures. SAP has implemented a multi-layered defense strategy as a protection against unauthorized modifications. • In particular, SAP uses the following to implement the control and measure sections described above: • Firewalls; • Security Monitoring Center; • Antivirus software; • Backup and recovery; • External and internal penetration testing; • Regular external audits to prove security measures. Appendix 3 to the DPA and, if applicable, the Standard Contractual Clauses The following table sets out the relevant Articles of GDPR and corresponding terms of the DPA for illustration purposes only.;