On ArcGIS Enterprise & Related Products' Privacy Page you can request and collect all the privacy and GDPR related information that ArcGIS Enterprise & Related Products is providing.
The privacy policy by is a legal document or statement that discloses how ArcGIS Enterprise & Related Products gathers, uses, discloses, and manges their customers' data.
The basis for Esri sharing, adding, uploading, hosting, accessing or sending personal data out of Europe. Vendors can also add a description of their own impact assessment for data transfers.