--- title: "GDPR AI Procurement for German Enterprises: Step-by-Step Guide (2026)" description: "GDPR AI procurement for German enterprises requires role mapping, DPIA screening, transfer review, DPA terms, and ongoing vendor governance." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/compliance/gdpr-ai-procurement/" language: "en" --- ![GDPR AI procurement workflow for German enterprise buyers](https://compound.law/assets/images/compliance/compliance_2.webp) Guides # GDPR AI Procurement for German Enterprises: Step-by-Step Guide (2026) 20 May 2026 GDPR AI Procurement: Core Answer GDPR AI procurement means assessing an AI tool before purchase, not after rollout. German enterprises should confirm the vendor's role under Article 4 GDPR, check whether a DPIA under Article 35 is required, review Chapter V transfer risks, negotiate an Article 28 DPA where needed, and document go-live controls before the tool is used. - The legal review should start before a pilot, proof of concept, or paid rollout begins. - Controller or processor classification changes the contract package and liability profile. - US or other non-EU AI vendors usually trigger transfer analysis and SCC review. - Procurement is not finished at signature; monitoring, retention, and deletion controls must continue. **GDPR AI procurement** for German enterprises means running the legal and data protection review before an AI tool is purchased, piloted, or connected to business data. A compliant process usually includes six steps: define the use case, classify the vendor’s role under the GDPR, decide whether a **Data Protection Impact Assessment (DPIA)** is required, review international transfers, negotiate the contract package, and set post-signature controls before launch. This matters because AI procurement is rarely just a purchasing decision. Once a tool touches employee data, customer data, uploaded contracts, support tickets, or internal communications, your company can face obligations under the **GDPR**, the **BDSG**, and in some cases the **BetrVG** and the **EU AI Act**. If those issues are discovered only after rollout, the procurement process has already failed. This guide sets out a practical step-by-step workflow for legal, procurement, privacy, IT, and security teams in Germany. It is general information only and not a substitute for legal advice on a specific deployment. ## Why GDPR AI Procurement Needs Its Own Workflow Many businesses still review AI vendors as if they were ordinary SaaS tools. That is often too narrow. AI systems create extra risk because they can involve: - broader data ingestion than the business originally expected - opaque vendor roles and unclear model training rights - non-EU processing chains and subprocessors - increased DPIA triggers under Article 35 GDPR - overlap with employee co-determination and sector rules That is why a **GDPR AI procurement workflow** should begin before the business team starts a pilot. Procurement should not wait until the DPA arrives at signature stage. Our related [GDPR AI vendor assessment checklist](https://compound.law/en-DE/compliance/gdpr-ai-vendor-assessment-checklist/) helps with DPA review, while this guide covers the full process from intake to ongoing governance. For the AI Act layer, see our guide to [EU AI Act procurement requirements for German enterprises](https://compound.law/en-DE/compliance/eu-ai-act-procurement-requirements-german-enterprises/). ## The 6-Step GDPR AI Procurement Workflow ### Step 1: Define the Use Case Before Reviewing the Vendor The first procurement question is not “Can the vendor sign our DPA?” It is “What exactly will this AI tool do in our organisation?” At intake stage, document: - the business function involved, such as HR, sales, legal, support, finance, or engineering - the categories of data the tool will receive - whether any **special categories of personal data** under Article 9 GDPR may be included - whether the tool will make recommendations only, or influence decisions about individuals - whether the tool will be used internally, externally, or in customer-facing workflows This scoping exercise determines whether you are reviewing a low-risk drafting assistant, an employee monitoring tool, a customer support bot, or a potentially high-risk decision system. That distinction affects everything that follows. **Practical rule:** If the requesting team cannot clearly describe what data enters the tool and what outputs are relied on, the legal review is not ready yet. ### Step 2: Decide Whether the Vendor Is a Processor, Controller, or Something Else This is one of the most important steps in **AI procurement GDPR compliance**. Many internal buyers assume every AI vendor is a processor. That is incorrect. Under the GDPR, the classification depends on who decides the purposes and essential means of processing: - A **processor** acts on your documented instructions. - A **controller** decides its own purposes and means. - A **joint controller** arrangement can arise where both parties shape the purposes together. For AI vendors, the difficult cases are the ones where the provider uses customer data for analytics, service improvement, abuse detection, model training, or product development. In that situation, the vendor may not be acting purely on your behalf. #### What procurement teams should ask 1. Does the vendor process the data only to provide the contracted service? 2. Does the vendor reserve rights to use prompts, outputs, uploads, or metadata for model improvement? 3. Can those rights be switched off by contract or admin settings? 4. Does the vendor rely on aggregated or de-identified data for its own purposes? If the vendor is a processor, an [Article 28 DPA](https://compound.law/en-DE/compliance/data-processing-agreement/) is usually required. If the vendor is a controller or joint controller for part of the processing, that must be analysed separately. A weak or inaccurate classification at this stage can undermine the entire contract structure. ### Step 3: Screen for DPIA Triggers Under Article 35 GDPR A **DPIA** is not required for every AI tool. But procurement teams should screen for it every time, and document the outcome. For many enterprise AI use cases, that screening is where the real legal risk sits. Common indicators that a DPIA may be required include: - large-scale processing of employee or customer data - systematic monitoring of individuals - profiling or scoring - use of sensitive data such as health, biometric, or union-related information - combining multiple datasets in a way that changes the privacy risk - automated decision-making with legal or similarly significant effects In Germany, employee-related tools deserve particular caution. Where AI supports hiring, performance analysis, scheduling, or workplace monitoring, there may also be labour-law implications under **Section 26 BDSG** and co-determination issues under **Section 87 BetrVG**. #### A fast DPIA triage table | Question | Why it matters | | ------------------------------------------------------------ | --------------------------------------------------- | | Does the tool process employee, applicant, or customer data? | Personal data is the entry point for GDPR analysis. | | Does the tool rank, score, profile, or prioritise people? | This can increase Article 35 and Article 22 risk. | | Is sensitive data likely to appear in prompts or uploads? | Article 9 GDPR raises the baseline risk materially. | | Is the tool monitoring behaviour or productivity? | German employment rules may apply in parallel. | | Are non-EU transfers or remote access involved? | Chapter V transfer analysis must be added. | If the answer to several of these questions is yes, a simple DPA review is usually not enough. The procurement file should include a formal DPIA decision, and where necessary a completed DPIA before launch. ### Step 4: Review Data Location, Subprocessors, and Transfer Mechanisms For many enterprises, the hardest part of **procuring AI tools under GDPR** is not the main contract. It is understanding the full vendor processing chain. Ask the vendor to confirm: - where customer content is stored - where support access occurs - where model inference occurs - which subprocessors receive personal data - whether any entity outside the EEA can access the data remotely Even where a vendor advertises “EU hosting”, that does not automatically solve the transfer issue. A US parent company, support team access from outside the EEA, or a non-EU model provider in the background can still create a transfer under **Chapter V GDPR**. #### Transfer mechanisms procurement should verify - **Adequacy decision:** for example the EU-US Data Privacy Framework, where applicable - **Standard Contractual Clauses (SCCs):** usually the European Commission’s 2021 SCCs - **Supplementary measures:** encryption, strict access controls, minimisation, and technical separation where transfer risk remains For AI tools with complex cross-border setups, your procurement notes should record not only the mechanism but also why it is legally usable for the planned deployment. If you need a deeper GDPR-only review of a specific vendor, our [AI Act and GDPR legal advisory page](https://compound.law/en-DE/compliance/ai-act-gdpr-legal-advisory/) explains how Compound Law approaches that analysis. ### Step 5: Negotiate the Full Contract Package, Not Just a DPA A mature **AI procurement due diligence GDPR** process should treat the contract as a package. For many AI tools, the governing terms, order form, DPA, security annex, subprocessor list, and product settings all work together. The legal file should usually include review of: - the main commercial agreement - the DPA or AVV, where Article 28 applies - SCC modules and transfer annexes, where relevant - security documentation and TOMs - vendor policies on training, retention, logging, and subprocessor changes #### Contract clauses that deserve close attention ##### 1. Instructions and processing purpose The DPA should clearly state the subject matter, duration, purpose, and categories of data and data subjects. Vague drafting often hides the fact that the actual processing is broader than the business team expects. ##### 2. Model training and secondary use For AI tools, this point is central. The contract should state clearly whether customer data, prompts, outputs, attachments, and telemetry can be used for: - model training - product improvement - benchmarking - abuse detection - analytics unrelated to the contracted service If those uses exist, they need separate legal analysis. They cannot simply be ignored because the vendor also offers a DPA. ##### 3. Subprocessor changes The vendor should provide an up-to-date subprocessor list and a mechanism for notice of changes. Procurement should check whether the notice period is usable in practice and whether the customer has an objection right. ##### 4. Security measures and breach cooperation The contractual package should align with Article 32 GDPR and set expectations on encryption, access controls, logging, incident response, and breach notification support. This matters for launch approval and for later incident handling. ##### 5. Retention, deletion, and exit AI tools often generate derived data, logs, embeddings, or cached content. The procurement file should not assume that “account deletion” removes everything. Confirm: - retention periods - deletion timelines after termination - whether backups are excluded and for how long - whether derived artefacts remain in the vendor environment - whether deletion can be verified or certified Our [data processing agreement guide](https://compound.law/en-DE/compliance/data-processing-agreement/) explains the baseline GDPR expectations, but procurement should go further for AI-specific data flows. For a worked example of what such a review produces in practice, see the [DeepL DPA worked example](https://compound.law/en-DE/compliance/gdpr-ai-procurement/#worked-example-the-deepl-dpa-clause-by-clause) below. ### Step 6: Set Go-Live Conditions and Ongoing Governance GDPR AI procurement does not end when the contract is signed. The final step is to define what must happen before the tool is actually used, and what must continue afterwards. Before go-live, many German enterprises should require: 1. completed legal and privacy sign-off 2. final vendor documentation in the procurement file 3. technical configuration checks, including training opt-outs where available 4. user guidance on approved and prohibited inputs 5. an internal owner for re-assessment if the use case changes After launch, ongoing governance should cover: - periodic vendor review - monitoring of subprocessor changes - reassessment if the tool expands into new data or new business units - deletion and offboarding checks when the contract ends - alignment with the company’s record of processing activities under Article 30 GDPR This is also where the GDPR workflow meets broader AI governance. If the use case could fall within a high-risk area under the AI Act, your procurement team should also review the [EU AI Act date split for German procurement teams](https://compound.law/en-DE/compliance/eu-ai-act-august-2026-deadline-checklist/) and our [EU AI Act procurement guide](https://compound.law/en-DE/compliance/eu-ai-act-procurement-requirements-german-enterprises/). ## Worked Example: The DeepL DPA, Clause by Clause **DeepL SE provides a data processing agreement (DPA) under Article 28 GDPR for all paid Pro services, and under the current DeepL Pro terms that DPA is an integral part of the contract, binding automatically upon conclusion — no separate signature is required.** The document is published in the [DeepL Trust Center](https://deepl.safebase.us/), alongside the subprocessor list — which since 2026 includes **AWS** — the security measures (TOMs), and the **Standard Contractual Clauses (SCCs)** used for transfers outside the EEA. The annotation below (reviewed October 2026) shows what a document-level vendor review produces in practice. ### The quick facts for the vendor file | Item | What DeepL documents (as of October 2026) | | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Contracting entity | DeepL SE, Maarweg 165, 50825 Cologne, Germany | | Legal basis | Integral part of the DeepL Pro Terms, binding upon conclusion (Pro Terms §8.1.5) | | Roles | Customer = controller; DeepL SE = processor; AWS = subprocessor | | Transfer mechanism | EU–U.S. Data Privacy Framework + SCCs; Transfer Impact Assessment in the Trust Center | | Default processing location | Global AWS regions (EU, US, JP) plus DeepL servers in Europe; transient by default | | Retention | Transient by default; encrypted debugging exception up to 72 hours; requested storage (e.g., saved translations) deleted up to 90 days after the agreement ends | | Security attestations | ISO/IEC 27001:2022, SOC 2 Type 2, BSI C5 (Type 2), plus a published TOMs document | | Free products | Free API may store content indefinitely; personal data is prohibited on the free API (Pro Terms §3.3.2, §8.3.11) | ### How to obtain the DPA and what to check in it 1. **Get the document set from the Trust Center.** The Legal section lists the Data Processing Agreement together with “DPA Sub-Processors”, the TOMs document, and the International Transfer Clauses. Downloading runs through an access-request flow; archive the set together with the Pro Terms and the order form. 2. **Confirm the Art. 28 core terms.** Documented instructions and lawful-collection duties (§8.1.5), encryption in transit and at rest with keys controlled by DeepL, subprocessor transparency with an objection mechanism, and controller assistance through the data flow diagram and vendor TIA. 3. **Record the retention terms precisely.** Transient processing by default, the 72-hour encrypted debugging exception, and 90-day post-termination deletion for requested storage — concrete terms you can quote in your Article 30 processing record. 4. **Check the automatic-incorporation mechanics.** Pro Terms §8.1.5 binds the DPA on conclusion of the Pro subscription; enterprise customers receive the bundle through their account team, together with any Data Residency terms. ### What the AWS change in 2026 means for approval Since January 1, 2026, DeepL has processed business and enterprise content on **AWS in addition to its own European data centers**, with AWS documented as a subprocessor. Customer content may be processed across global AWS regions (EU, US, JP) unless the contract says otherwise. The **Data Residency add-on** pins processing to one selected region for sales-assisted Team, Business, and API for Business customers and is standard in DeepL for Enterprise — EU-only processing is now a purchased contractual control, not the baseline. Customers who object to the AWS-inclusive terms can use the service until the end of the current billing period, with content kept on DeepL infrastructure until the contract ends. That makes DeepL a textbook example of this guide’s transfer step: “EU hosting” claims, remote support access, and the subprocessor chain must be read from the documents, not the marketing page. It also shows the limits of a DPA: sector-specific confidentiality duties, high-risk assessment under the EU AI Act (Pro Terms §8.1.2), and usage-data processing (§3.1.10) all remain the customer’s responsibility — and the free tier sits entirely outside this DPA regime. ## A Practical GDPR AI Procurement Checklist Use this procurement checklist before approving any enterprise AI tool: 1. **Use case documented:** The requesting team has described the business purpose, user group, and data inputs. 2. **Personal data confirmed:** Procurement has identified whether personal data is involved and whether Article 9 data may appear. 3. **Role classification completed:** The vendor has been assessed as processor, controller, or mixed-role provider. 4. **DPIA screening recorded:** Legal or privacy has documented whether Article 35 GDPR is triggered. 5. **Transfer chain reviewed:** Data location, remote access, subprocessors, and transfer mechanism are documented. 6. **Contract package reviewed:** Main terms, DPA, SCCs, TOMs, and vendor policy documents have been checked together. 7. **Training rights addressed:** Contractual or technical controls prevent unwanted model training on company data. 8. **Launch controls set:** Users know what data they may and may not enter into the tool. 9. **Article 30 records updated:** The processing activity is reflected in internal records where required. 10. **Reassessment trigger defined:** Procurement knows who reopens the review if the tool’s use case changes. ## Common Mistakes in AI Procurement Due Diligence German enterprises often lose time by discovering the real issues too late. The most common mistakes are: - running a pilot before legal and privacy review starts - assuming “enterprise plan” means GDPR compliance is solved - treating every vendor as a processor without analysing the role - checking only storage location, but not remote access or subprocessors - signing SCCs without documenting the actual transfer scenario - forgetting employee participation and works council issues - failing to restrict what staff can upload into the tool after launch For AI tools used in employee contexts, our guide on [enterprise AI legal risk](https://compound.law/en-DE/compliance/enterprise-ai-legal-risk/) is also relevant because GDPR issues often overlap with governance, labour, and liability questions. ## How This Fits with the EU AI Act Not every AI procurement matter is a GDPR matter only. Some enterprise use cases also raise obligations under the **EU AI Act**, especially where the system may be high-risk under Annex III or where transparency duties apply. The key point is that the GDPR and AI Act solve different problems: - **GDPR** focuses on personal data, lawful processing, security, transfers, and data subject protection. - **EU AI Act** focuses on AI system classification, transparency, human oversight, and conformity obligations for certain systems. That is why a German enterprise may need both: - a compliant Article 28 DPA and transfer package for the personal-data side - a separate AI Act procurement review for the AI-system side If your use case combines both, procurement should not split the analyses into separate silos. The better approach is one intake process with different legal workstreams. ## When to Escalate the Review Standard procurement may not be enough where the AI tool: - materially affects employees, applicants, customers, or borrowers - processes special categories of personal data - is integrated into automated or semi-automated decision-making - is supplied by a non-EU vendor with a layered subprocessor structure - cannot offer clear training opt-outs or retention controls In those cases, escalation to specialist counsel before signature is usually faster than trying to repair the position later. The earlier the issue is identified, the more leverage procurement still has. ## Need Help with AI Procurement in Germany? Compound Law advises German businesses and enterprise teams on **GDPR AI procurement**, DPA review, transfer assessments, AI governance, and AI Act readiness. If your organisation is procuring AI tools for HR, legal, customer operations, or internal productivity use cases, our page on [AI legal counsel in Germany](https://compound.law/en-DE/compliance/ai-act-gdpr-legal-advisory/) explains how we support procurement, contract review, and rollout approval in one advisory stream. *** *This article provides general information only and does not constitute legal advice. Specific AI procurement decisions depend on the tool, the processing setup, the contract package, and the intended use in your organisation.* ## Related Compliance Guides [![GDPR-compliant AI implementation for businesses in Germany](https://compound.law/assets/images/compliance/compliance_1.webp)](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [Guides](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) ### [GDPR-Compliant AI in Germany: A Practical Guide for 2026](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [GDPR-compliant AI means a lawful basis, transparency, a DPA, controlled transfers and a DPIA where risk is high. The 2026 guide for German companies.](https://compound.law/en-DE/compliance/gdpr-compliant-ai-businesses-germany/) [![AI legal counsel in Germany for company AI procurement](https://compound.law/assets/images/compliance/compliance_3.webp)](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [Guides](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) ### [AI Legal Counsel in Germany for Companies](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [AI legal counsel in Germany helps companies handle EU AI Act, GDPR, DPA, procurement, and rollout risk before signing or launching AI tools.](https://compound.law/en-DE/compliance/ai-legal-counsel-germany/) [![EU AI Act procurement before 2027 for German buyers](https://compound.law/assets/images/compliance/compliance_3.webp)](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) [compliance](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) ### [EU AI Act Procurement Before 2027 in Germany](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) [EU AI Act procurement before 2027 matters now for German buyers because contracts, evidence flows, and deployer support should be fixed before rollout.](https://compound.law/en-DE/compliance/eu-ai-act-procurement-before-2027/) ## Frequently asked questions GDPR AI procurement is the process of buying or approving an AI tool in a way that satisfies GDPR before the tool is used in the business. For German enterprises, that usually means mapping the vendor's role, checking whether personal data is involved, assessing transfer risks, putting a compliant Article 28 DPA in place where required, and documenting operational controls before go-live. No. A DPA is required when the vendor processes personal data on your behalf as a processor. If the vendor determines its own purposes for processing, it may be a controller or joint controller instead, which requires a different legal analysis and usually cannot be solved by simply signing a DPA. A DPIA under Article 35 GDPR is required where the planned processing is likely to result in a high risk to individuals. In AI procurement, common triggers include large-scale profiling, employee monitoring, sensitive personal data, systematic monitoring, or automated decision-making with significant effects. German companies should check where data is stored, where remote access occurs, whether sub-processors are located outside the EEA, whether the vendor relies on the EU-US Data Privacy Framework or SCCs, and whether supplementary measures are needed after the Schrems II transfer-risk assessment. Yes. DeepL SE publishes a data processing agreement under Article 28 GDPR in its Trust Center. Under the current DeepL Pro terms (§8.1.5) the DPA is an integral part of the Pro agreement and becomes binding automatically upon contract conclusion, so paid customers do not need to negotiate or countersign it. Downloading and archiving a copy for the vendor file is still good practice. Usually you do not sign anything separately. DeepL Pro Terms §8.1.5 makes the Trust Center DPA an integral part of the agreement, binding upon conclusion. Enterprise customers receive the DPA through their account or sales contact, together with any Data Residency terms. In both cases, download and archive the DPA, subprocessor list, TOMs, and transfer clauses before transmitting personal data. Yes. Under the 2026 hybrid infrastructure model, DeepL processes business and enterprise customer content on AWS in addition to its own European data centers, and AWS is documented as a subprocessor. DeepL's own translation models run in a DeepL-controlled environment. The current subprocessor list is published as a legal document in the Trust Center, and DeepL's infrastructure notice describes the objection path for subprocessor changes. Yes, as a contractual add-on. The Data Residency option is available to sales-assisted customers on Team, Business, and API for Business plans and is included as standard in DeepL for Enterprise. One region per organization — EU, US, or JP — must be purchased for all subscriptions in scope. Operational logging and monitoring may run outside the selected region, but DeepL states they do not contain customer content data. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "GDPR AI Procurement for German Enterprises: Step-by-Step Guide (2026)", "description": "GDPR AI procurement for German enterprises requires role mapping, DPIA screening, transfer review, DPA terms, and ongoing vendor governance.", "image": "https://compound.law/assets/images/compliance/compliance_2.webp", "datePublished": "2026-05-20T00:00:00.000Z", "dateModified": "2026-05-20T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/compliance/gdpr-ai-procurement/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "Compliance Guides", "item": "https://compound.law/en-DE/compliance/" }, { "@type": "ListItem", "position": 3, "name": "GDPR AI Procurement for German Enterprises: Step-by-Step Guide", "item": "https://compound.law/en-DE/compliance/gdpr-ai-procurement/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is GDPR AI procurement?", "acceptedAnswer": { "@type": "Answer", "text": "GDPR AI procurement is the process of buying or approving an AI tool in a way that satisfies GDPR before the tool is used in the business. For German enterprises, that usually means mapping the vendor's role, checking whether personal data is involved, assessing transfer risks, putting a compliant Article 28 DPA in place where required, and documenting operational controls before go-live." } }, { "@type": "Question", "name": "Do all AI tools require a DPA under Article 28 GDPR?", "acceptedAnswer": { "@type": "Answer", "text": "No. A DPA is required when the vendor processes personal data on your behalf as a processor. If the vendor determines its own purposes for processing, it may be a controller or joint controller instead, which requires a different legal analysis and usually cannot be solved by simply signing a DPA." } }, { "@type": "Question", "name": "When does AI procurement trigger a DPIA in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "A DPIA under Article 35 GDPR is required where the planned processing is likely to result in a high risk to individuals. In AI procurement, common triggers include large-scale profiling, employee monitoring, sensitive personal data, systematic monitoring, or automated decision-making with significant effects." } }, { "@type": "Question", "name": "What should German companies check with non-EU AI vendors?", "acceptedAnswer": { "@type": "Answer", "text": "German companies should check where data is stored, where remote access occurs, whether sub-processors are located outside the EEA, whether the vendor relies on the EU-US Data Privacy Framework or SCCs, and whether supplementary measures are needed after the Schrems II transfer-risk assessment." } }, { "@type": "Question", "name": "Does DeepL have a DPA?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. DeepL SE publishes a data processing agreement under Article 28 GDPR in its Trust Center. Under the current DeepL Pro terms (§8.1.5) the DPA is an integral part of the Pro agreement and becomes binding automatically upon contract conclusion, so paid customers do not need to negotiate or countersign it. Downloading and archiving a copy for the vendor file is still good practice." } }, { "@type": "Question", "name": "How do I sign the DeepL DPA?", "acceptedAnswer": { "@type": "Answer", "text": "Usually you do not sign anything separately. DeepL Pro Terms §8.1.5 makes the Trust Center DPA an integral part of the agreement, binding upon conclusion. Enterprise customers receive the DPA through their account or sales contact, together with any Data Residency terms. In both cases, download and archive the DPA, subprocessor list, TOMs, and transfer clauses before transmitting personal data." } }, { "@type": "Question", "name": "Does DeepL use AWS or other subprocessors?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Under the 2026 hybrid infrastructure model, DeepL processes business and enterprise customer content on AWS in addition to its own European data centers, and AWS is documented as a subprocessor. DeepL's own translation models run in a DeepL-controlled environment. The current subprocessor list is published as a legal document in the Trust Center, and DeepL's infrastructure notice describes the objection path for subprocessor changes." } }, { "@type": "Question", "name": "Does DeepL offer EU data residency?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, as a contractual add-on. The Data Residency option is available to sales-assisted customers on Team, Business, and API for Business plans and is included as standard in DeepL for Enterprise. One region per organization — EU, US, or JP — must be purchased for all subscriptions in scope. Operational logging and monitoring may run outside the selected region, but DeepL states they do not contain customer content data." } } ] } ] ```