Data Report Card · DocuSign
DocuSign Data Report Card
B
10/12 Policy grade · E-signature · Docusign, Inc.
Reviewed Jun 2026 · policies are checked weekly for changes · stated — every cell is read from DocuSign's published policy; none has been tested (run by us) yet.
2Accessstated
DocuSign provides the right to access and receive a copy of the personal data it holds through the DocuSign Privacy Request Portal, satisfying the access right.
DocuSign — Data management and privacy practices · accessed Jun 2026 ↗1Portabilitystated
Access and copies are delivered through the Privacy Request Portal, but the documentation does not confirm a structured multi-format machine-readable export, so portability is scored at the single-format level.
DocuSign — Privacy Notice · accessed Jun 2026 ↗Connects to apps: Yes. DocuSign's eSignature REST API uses OAuth 2.0 Authorization Code Grant with refresh tokens (extended / offline scope) that a consumer grants to an app and can revoke, so agent access is scored at the full level. DocuSign — Authorization Code Grant (OAuth 2.0) · accessed Jun 2026 ↗
2Frictionstated
Rights are exercised through a self-serve DocuSign Privacy Request Portal rather than a manual email queue, placing friction at the low level.
DocuSign — Data management and privacy practices (Privacy Request Portal) · accessed Jun 2026 ↗2Deletionstated
At a customer's request DocuSign deletes all personal data in its possession as soon as reasonably practicable, except where legally required to retain it or where archived on backup systems, so deletion is scored at the full level.
DocuSign — Data Protection Attachment (deletion) · accessed Jun 2026 ↗1Sells / sharesstated
DocuSign does not describe selling personal data for money, but states it may aggregate or de-identify personal information for marketing, research, and product development, so data use is scored at the partial level.
DocuSign — Privacy Notice (aggregate / de-identify use) · accessed Jun 2026 ↗2Trains AIstated
DocuSign states it intentionally designs its systems to avoid training models using the personal information customers enter into its services, except where the customer has given consent — an opt-in / avoid-by-default posture scored at the full level.
DocuSign — Privacy Notice (avoids training on customer data without consent) · accessed Jun 2026 ↗Reviewed Jun 2026 from DocuSign's Privacy Notice and Data Management & Privacy pages. All cells "stated", not tested. DocuSign offers a self-serve Privacy Request Portal for access and deletion and takes a notably strong AI stance — it states it designs its systems to avoid training models on the personal information customers enter, except with consent. Weaknesses are format (portability not confirmed multi-format) and marketing use of aggregated / de-identified data.
Events
Breaches, policy changes, and export-format changes we’ve recorded at DocuSign — other parties’ actions, alongside the enforcement record above. An event never changes a grade by itself. All events →
No events on record for DocuSign.
Grade history
Every change to this company’s grade since it was first published, and why. All grade changes →
No changes since this grade was first published in Jun 2026.
How to request your data from DocuSign
- Go to https://www.docusign.com/privacy — DocuSign's data-request entry point.
- DocuSign Privacy Request Portal: access / copy / deletion of personal data.
- Expected wait: self-serve Privacy Request Portal for access / deletion; deletion honored except legal / backup retention; eSignature OAuth API — DocuSign's stated turnaround (we haven't independently timed a request yet).
- No self-serve option, or want a formal request? Contact DocuSign — Privacy Request Portal: https://www.docusign.com/privacy.
These steps reflect DocuSign's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.