Skip to content
Search
Support
 Select language
Cancel

Government and Law Enforcement Request Policy

This document is intended for use by government agencies, including law enforcement, who are seeking disclosure of customer and user information for civil, administrative, criminal, and national security purposes.

KnowBe4 is committed to protecting the privacy and security of customer data while meeting our legal obligations. We endeavor to cooperate with law enforcement and government agencies in responding to legitimate requests while safeguarding customer privacy. When we receive a government or law enforcement request, we carefully review it for legal validity, proper jurisdiction, and appropriate scope, and may object to or reject requests that we interpret as overly broad, vague, or legally deficient. As a processor of customer data across multiple jurisdictions, KnowBe4 must ensure compliance with various international privacy laws and regulations, including the European Union’s General Data Protection Regulation (GDPR), and other applicable data protection requirements, and will evaluate each request to ensure it does not conflict with our legal obligations or customer contractual commitments in other jurisdictions.

Types of information:

“Customer Data” means data and other information including, but not limited to, Personal Data Processed or stored through the Subscription Services by Customer or on behalf of Customer.

“Threat Intelligence Data” means information collected, generated, derived, and/or analyzed by the Service that is related to malicious activities, fraud, accidental loss, human error, threat or other harm detection and analysis identified by the Service such as a third-party malicious actor’s IP address, email address, name, and hashes of malware.

“Usage Data” means Personal Data, including Threat Intelligence Data, relating to or obtained in connection with the use, performance, operation, support or use of the Services, including via their connection to Third-Party Products. Usage Data may include event name (i.e. what action Users performed), event timestamps, browser information, diagnostic data, data types, file sizes, and similar information associated with data from the Services and Third-Party Products that Customer connects to the Services. For clarity, Usage Data does not include Customer Personal Data.

We make a distinction between requests received for disclosure of Customer Data and Usage Data. We:

  • Will disclose Usage Data information only in response to valid and binding legal requests; and
  • As a processor of Customer Data controlled by our customers, KnowBe4 will not disclose Customer Data in response to legal requests except where directly compelled by valid legal process, such as a court order. Requesting parties should direct such requests to the relevant customer who controls the data.

Preservation Requests:

We will preserve the requested information following receipt of a valid and binding preservation request for 90 calendar days, unless we receive a valid order for extension, or as otherwise required by law. We will only preserve information up to 90 calendar days prior to the date of the request – information produced or created after this date will not be preserved under the same request.

Witness Testimony:

We will not waive legal requirements for subpoenas seeking witness testimony. Upon receipt of a valid and binding legal request, KnowBe4 will provide a certification of authenticity or regulatory conducted business activity in lieu of witness testimony.

Civil Requests:

Civil requests must follow an appropriate local legal process. Information, records and testimony requested must proceed under Fla. Stat. §92.251 (UIDDA) and related Florida subpoena and discovery rules.

Notifications:

Unless prohibited by applicable law, we will notify the relevant customer or user before making any disclosure in respect of a valid and binding legal request. This may involve disclosing information (e.g., date and nature of request and the party making it). We may also disclose aggregated statistics relating to the number of disclosure requests received.

Costs reimbursement:

KnowBe4 reserves the right to seek reimbursement for costs incurred in responding to legal requests, as permitted by applicable law, including 18 U.S.C. § 2706 (United States) and comparable provisions in other jurisdictions. Costs may include personnel time for research, data retrieval, legal review, technical analysis, and document production, as well as associated expenses for media, storage, certification, and authentication. KnowBe4 may require advance payment or deposit for complex or voluminous requests, and reserves the right to delay production pending payment for costs exceeding certain thresholds.

Method of disclosure

When making disclosure in response to a valid and binding legal request, the following applies:

  • All results will only be provided in a format of our choosing unless otherwise agreed;
  • We will return results via email to the requestor using appropriate communication methods;
  • If a request requires the production of large datasets, we reserve the right to disclose documents using secure storage solutions;
  • We are not responsible for any blocking of response emails by the requestor’s email system (including any anti-spam email tools). The requestor must ensure the designated recipient can receive emails from our domain, knowbe4.com; and
  • We will not send any disclosures to any free web-based email address.

Making a request

We require due legal process to be observed and followed in the relevant jurisdiction(s) and will not release information without proper service of a valid and binding legal request. Requests must:

  • Correctly identify the relevant legal entity as the service provider the request is made of;
  • Identify the legislation, court order or other official authority instruction in reliance on which the request is made;
  • Provide the full name of the relevant customer or user to whom the request relates;
  • Provide the name, title and contact information of the person making the request and to whom disclosure is requested;
  • Be made on headed paper of, or sent from an email account at the law enforcement authority making the request; and
  • Be as narrow and specific as possible. We may object to overly broad or inappropriate requests.

All requests must be made to:

Entity: KnowBe4, Inc.

Address: 33 N Garden Ave, Suite 1200, Clearwater, Florida 33755, United States

Attention: Legal Department legal@knowbe4.com

Emergency Requests

In circumstances involving imminent danger of death or serious physical injury, KnowBe4 may disclose information without a formal legal process if we reasonably believe that we can prevent harm, provided the request is made by law enforcement. Such requests must clearly articulate the emergency nature and clearly specify what information is needed and why. The request must be documented in writing (email acceptable for emergency) and clearly marked "EMERGENCY REQUEST" in any letter or email subject line. We will still consider these requests in light of applicable laws and our policies.

Requests relating to data held outside of the stated jurisdictions

Legal requests must follow applicable law. If the legal request relates to personal data, personal information or personally identifiable information held outside the jurisdiction in which the request is served, the requestor must follow relevant legal, political and diplomatic channels in that jurisdiction to lawfully and appropriately seek disclosure from KnowBe4.

A list of our affiliates can be found here (listed as affiliate subprocessors):

https://support.knowbe4.com/hc/en-us/articles/1500007523981-KnowBe4-Sub-Processors

Reservation of Rights

KnowBe4 reserves the right to object to, seek modification of, or challenge any request that is overly broad, unduly burdensome, vague, lacks proper legal foundation, seeks privileged information, or fails to comply with applicable law. Factors considered include the scope and volume of data requested, time and resources required for compliance, availability of information from alternative sources, and potential disruption to business operations. KnowBe4 may file motions to quash, motions for protective orders, or seek to narrow the request to what is reasonably necessary and proportional to the legitimate needs of the investigation or proceeding. Production will be stayed pending resolution of such objections unless otherwise ordered by a court of competent jurisdiction.

Transparency Reporting

KnowBe4 is committed to transparency regarding government and law enforcement requests for user information. We may periodically publish aggregate statistics and metrics related to the requests we receive, including the number and types of legal process received, the requesting jurisdictions, categories of information sought, and our response outcomes (such as requests where information was provided, objected to, or rejected). These reports help inform the public and our customers about how we handle legal demands while protecting privacy. Specific case details and information that would compromise ongoing investigations or violate confidentiality obligations will not be disclosed. Transparency reports, when published, will be made available at https://www.knowbe4.com/legal, or such other URL locations on KnowBe4’s website as KnowBe4 may provide from time to time.