Guidelines for Law Enforcement Agencies

Effective Date: September 2026

Sophos Limited and its affiliates ("Sophos") provide cybersecurity products, managed security services, incident response services, and related technology solutions designed to help organizations protect against cyber threats and strengthen their security posture. As a result of these services, Sophos may obtain information from and about our customers. Sophos recognizes its important obligation to protect the privacy and other rights of its customers while respecting and complying with the rules and laws of each jurisdiction in which it operates. For this reason, Sophos carefully reviews each request it receives from any law enforcement agency seeking customer information and provides such information in response to such requests only when Sophos reasonably believes that it is legally required to do so.

Information Sophos May Maintain

Sophos may maintain customer-related information in connection with providing its products and services and operating its business. The information available in response to a law enforcement request will depend on the Sophos product or service involved, the customer relationship, the applicable retention periods, and the nature and scope of the legal process received.

Role of Sophos Regarding Customer Data

Depending on the product or service involved and the nature of the information at issue, Sophos may act as a data controller or data processor. In many cases, Sophos processes information on behalf of customers, who determine the purposes and means for processing that information. When legally permitted and appropriate, Sophos may consult with or notify the affected customer, or direct the requesting authority to the customer, regarding requests for access to customer-controlled information.

Responding to Law Enforcement Requests

In evaluating any law enforcement agency request for information, Sophos applies the following guidelines:

• To obtain customer information, a law enforcement agency must provide legal process (such as a subpoena, court order, or search warrant) appropriate to the type of information sought. If production is prohibited by law or if the legal process served is insufficient to compel production under applicable law, Sophos will refuse to produce the requested information. Sophos evaluates requests from government and law enforcement authorities in accordance with applicable laws and regulations. Requests from authorities outside the jurisdiction of the relevant Sophos entity may be required to proceed through applicable international cooperation mechanisms, mutual legal assistance processes, or other legally recognized channels.
• Sophos will strictly construe all requests for information and will object to and/or seek to limit requests that are overbroad, seek an unreasonably large volume of information, unreasonably relate to a large number of customers, seek information protected from disclosure by the attorney-client privilege or attorney work product doctrine, or are otherwise subject to objection or limitation.
• Sophos reserves the right to seek reimbursement for costs associated with responding to law enforcement requests for information, where appropriate.
• Sophos policy is to notify any customer promptly of a request for that customer’s information so that the customer may object and/or take appropriate steps to block the production of such information. When legally permitted and appropriate, Sophos generally seeks to provide affected customers with at least seven (7) days' notice of requests for their information before disclosure, allowing them an opportunity to seek legal protection or otherwise respond.
• Sophos may shorten that seven-day period at its discretion, but generally will do so only when satisfied that there is an emergency or other lawful basis requiring that it does so.
• If a law enforcement agency believes that notification would jeopardize an investigation or pose some other danger, the agency should obtain an appropriate court order or other process that legally and specifically prohibits customer notification. Sophos will not refrain from notifying a customer based only upon the request of a law enforcement agency.

As a general policy, if a request places Sophos on notice of conduct that may violate its contractual terms, acceptable use requirements, or applicable law, Sophos reserves the right to take appropriate action consistent with its legal obligations, contractual rights, and internal policies. If a law enforcement agency believes that taking such actions would jeopardize an investigation or pose some other danger, the agency should request that Sophos defer such action. Sophos will evaluate such requests on a case-by-case basis and Sophos expressly reserves the right to take such action as it deems appropriate under the specific circumstances.

Law Enforcement Record Preservation Requests

Where applicable law permits or requires, upon request by a law enforcement agency to do so, Sophos will preserve any identified customer information in its possession for a period of 90 days, and will preserve it for an additional 90 days upon receipt of a request for such an extension. If Sophos does not receive valid legal process for the production of such information by the end of such preservation periods, the information may be deleted thereafter as part of Sophos’s ordinary business processes.

A preservation request must be sent on official law enforcement letterhead and be signed by a law enforcement official. The request must include (1) the relevant account number (or other sufficient identifying information) for the customer whose information the agency requests that Sophos preserve; (2) a valid return email address; and (3) a statement that steps are being taken to obtain a court order or other appropriate legal process for production of the information that the agency requests that Sophos preserve. The preservation request may be emailed to [email protected] or mailed to Sophos Inc., Attn.: Legal Department, 3090 Nowitzki Way, Suite 300, Dallas, TX 75219, United States.

Requests for Production of Information:

When requesting customer information, a law enforcement agency should provide as much of the following information as is available, as that will facilitate Sophos’s ability to respond in an effective and timely manner, including: name, email address, physical address, phone number, dates of service, and the specific regulatory framework, computing application, or systems that are the subject of the request.

Each request must also include contact information for the authorized law enforcement agency official submitting the request, including the agency’s name, the requesting officer’s badge or other identification number, phone number, physical mailing address (P.O. boxes not accepted), and employer-issued email address. The request should also clearly state the requested response date.

Requests may be emailed to [email protected] or mailed to Sophos Inc., Attn.: Legal Department, 3090 Nowitzki Way, Suite 300, Dallas, TX 75219, United States. While Sophos agrees to accept service of law enforcement requests by these methods, neither Sophos nor its customers waive any legal rights based upon this accommodation.

If a law enforcement agency provides information that gives Sophos a good faith belief that there is an emergency involving imminent danger of death or serious physical injury to any person, Sophos may exercise its discretion to provide information immediately to prevent that harm if it is in a position to do so and can do so consistent with applicable law. Sophos will seek to limit any emergency disclosure to information it determines in good faith is necessary to address the emergency.

Please note that requests seeking testimony must be personally served on our registered agent for service of process. We do not accept such requests by email or postal service.

Additional information regarding Sophos's privacy practices can be found in the Sophos Group Privacy Notice.

Disclaimer

These guidelines are intended to serve as an informational resource, and do not create any rights or obligations on the part of Sophos, its customers, or any other person or entity. Any questions about these guidelines or other issues relating to Sophos’s treatment of law enforcement agency requests for information may be emailed to [email protected].