On ArcGIS Desktop & Related Products' Privacy Page you can request and collect all the privacy and GDPR related information that ArcGIS Desktop & Related Products is providing.
The privacy policy by is a legal document or statement that discloses how ArcGIS Desktop & Related Products gathers, uses, discloses, and manges their customers' data.
The basis for Esri sharing, adding, uploading, hosting, accessing or sending personal data out of Europe. Vendors can also add a description of their own impact assessment for data transfers.