--- title: "Canva DPA: Yes, for Teams & Enterprise Plans" description: "Canva provides a DPA for Teams and Enterprise plans. GDPR guide: AI training data opt-out, data residency, and sub-processor checks for Germany." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/canva-ai/" language: "en" --- ![Canva GDPR compliance and data processing agreement for German companies](https://compound.law/assets/images/tools/tools_3.webp) tools # Canva DPA: Yes, for Teams & Enterprise Plans 5 April 2026 **Yes, Canva does have a Data Processing Agreement (DPA) — but it is only available on Canva Teams and Canva Enterprise plans.** German and DACH companies evaluating Canva under GDPR need to verify more than DPA availability: AI training data practices, data residency, and works council obligations all require attention before deployment. For a broader comparison of AI design and creative tools available to German businesses, see the [AI tools assessed by Compound Law](https://compound.law/en-DE/tools/). ## What is Canva? Canva is a cloud-based design platform headquartered in Australia. It offers templates, image editing, presentation tools, and an expanding suite of AI features — including **Magic Write** (AI text generation), **Magic Media** (text-to-image and text-to-video generation), and **Magic Design** (AI-assisted layout generation). These AI features process user content through Canva’s backend and, in some cases, third-party AI model APIs. Because Canva processes design content, text, and potentially personal data on behalf of business customers, it functions as a data processor under GDPR Article 28. A valid Data Processing Agreement is required before processing personal data through the platform in a professional context. ## Is Canva GDPR-Compliant? Canva can be used in a GDPR-compliant manner with the correct plan and contractual setup. The free Canva plan does not include a DPA and is not suitable for processing personal data in a business context under GDPR. Key points for German companies: - **DPA availability:** Available on Canva Teams and Canva Enterprise. Free plan users are not covered by a DPA. - **AI training data:** Canva states it does not use content from Teams and Enterprise accounts to train AI models. Free plan users may have their content used for model improvement — check the current terms. - **Data residency:** Canva offers data residency options for Enterprise customers. For Teams accounts, data is processed across Canva’s global infrastructure, including infrastructure in the United States. - **Sub-processors:** Canva maintains a published sub-processor list. Third-party AI model providers are included when Canva’s AI features are used. - **Standard Contractual Clauses:** Canva includes SCCs in its DPA for transfers of personal data from the EU/EEA to Australia and the United States. ## Does Canva Have a DPA? Yes. Canva provides a Data Processing Agreement for Teams and Enterprise customers. The DPA covers Canva’s processing of personal data on behalf of the business customer, including data processed through Canva’s AI features. For the clause-by-clause review of the agreement itself — SCC modules, subprocessor objection windows, and audit rights — see our [Canva DPA guide](https://compound.law/en-DE/tools/canva-dpa/). For German companies, the DPA is a starting point, not the finish line. You also need to: 1. Confirm that Standard Contractual Clauses are in place for transfers to Canva (Australia) and any US-based sub-processors. 2. Update your records of processing activities (**Verzeichnis von Verarbeitungstätigkeiten**, Article 30 DSGVO) to include Canva. 3. Conduct a Data Protection Impact Assessment (DPIA) if Canva will process sensitive personal data or if the AI features will be used in a context involving significant risk to data subjects. 4. Review sub-processor notifications — Canva notifies customers of sub-processor changes; ensure your process captures these updates. Compare this with [Adobe Firefly](https://compound.law/en-DE/tools/adobe-firefly/), which is tightly integrated with Creative Cloud enterprise agreements and offers comparable data protection commitments for enterprise customers. ## Canva AI Features and GDPR Canva’s AI features introduce additional data protection considerations beyond standard document and image storage: **Magic Write** generates text based on user prompts. The prompts — which may contain personal data or confidential business information — are processed by Canva’s AI infrastructure. For Teams and Enterprise plans, Canva confirms this content is not used for model training. **Magic Media** (text-to-image and text-to-video) similarly processes text prompts. The images and videos generated are stored in the user’s Canva account and subject to Canva’s standard data retention terms. **Magic Design** analyzes existing design assets and generates layout suggestions. This involves Canva processing uploaded images, which may contain personal data (e.g., photographs of people in marketing materials). For guidance on the broader compliance landscape for AI-generated imagery, see our [AI image generation compliance guide](https://compound.law/en-DE/compliance/ai-image-generation/). For AI writing tools specifically, see [AI writing assistants and GDPR](https://compound.law/en-DE/compliance/ai-writing-assistants/). ## What German Marketing Teams Need to Know German companies — especially marketing and design teams — face specific GDPR considerations when using Canva: **Works Council (Betriebsrat) involvement:** Under §87 BetrVG, works councils have co-determination rights over the introduction of technical monitoring systems. If Canva is used across a team and generates usage analytics, activity logs, or productivity metrics, Betriebsrat consultation may be required before rollout. **Free plan vs. paid plans:** The compliance gap between Canva’s free plan and its Teams/Enterprise plans is significant. Free plan data handling terms are not suitable for professional use involving personal data. If employees are currently using Canva free accounts for work purposes, this should be addressed in your IT and data protection policy. **Client-related design work:** Agencies and professional services firms creating designs that include client data (e.g., customer names, photographs, sensitive information) must treat Canva as a data processor for that personal data. A DPA covering that processing must be in place. **AI feature opt-out:** Some AI features can be disabled at the account level on Teams and Enterprise plans. If your compliance assessment concludes that certain AI features are not appropriate for your use case, verify that these can be disabled and document that decision. ## Our Assessment For German marketing teams and designers, Canva Teams is deployable with proper setup. The DPA is available, AI training data exclusions apply on paid plans, and sub-processors are documented. The main compliance steps are the same as with any cloud tool with AI features: sign the DPA, put SCCs in place, review sub-processors, and consult your Betriebsrat if the tool will be used across a team. Canva AI is particularly prevalent in [media and entertainment AI compliance](https://compound.law/en-DE/ai-act/media-entertainment/) environments and among [retail and e-commerce AI deployment](https://compound.law/en-DE/ai-act/retail-ecommerce/) teams creating product visuals and marketing assets at scale. We do not recommend using Canva’s free plan for any professional work involving personal data — there is no DPA, and the AI training data terms are not appropriate for business use. Compound Law can assist with DPA review, SCC implementation, DPIA preparation, and works council negotiations for Canva deployments. *** ## Frequently Asked Questions ### Does Canva have an AVV (Auftragsverarbeitungsvertrag)? Yes. Canva provides a Data Processing Agreement — the equivalent of an Auftragsverarbeitungsvertrag under Article 28 DSGVO — for Teams and Enterprise customers. This must be signed before deploying Canva in any context that involves personal data. ### Is Canva GDPR compliant for German companies? Canva can be used in a GDPR-compliant way on paid plans (Teams or Enterprise) with a signed DPA, Standard Contractual Clauses for international data transfers, and updated records of processing activities. The free Canva plan does not include a DPA and is not suitable for business use under GDPR. ### Does Canva use designs to train AI? For Teams and Enterprise accounts, Canva states it does not use customer content to train AI models. For free plan accounts, content may be used for model improvement. Check the current Canva terms of service and privacy policy for the most up-to-date position, as these can change. ### Can I use Canva for sensitive business documents under GDPR? With a signed DPA (Teams or Enterprise plan), SCCs in place, and a completed DPIA where required, Canva can be used for documents containing personal data. For documents containing special category data (Article 9 DSGVO) or confidential professional data, additional safeguards and legal assessment are recommended. ### Where is Canva data stored? Canva Enterprise customers can request data residency in specific regions. For Teams plan customers, data is processed across Canva’s global infrastructure, including infrastructure in the United States. Standard Contractual Clauses cover this international transfer under the DPA. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Yes. Canva provides a Data Processing Agreement — the equivalent of an Auftragsverarbeitungsvertrag under Article 28 DSGVO — for Teams and Enterprise customers. This must be signed before deploying Canva in any context that involves personal data. Canva can be used in a GDPR-compliant way on paid plans (Teams or Enterprise) with a signed DPA, Standard Contractual Clauses for international data transfers, and updated records of processing activities. The free Canva plan does not include a DPA and is not suitable for business use under GDPR. For Teams and Enterprise accounts, Canva states it does not use customer content to train AI models. For free plan accounts, content may be used for model improvement. Check the current Canva terms of service and privacy policy for the most up-to-date position, as these can change. With a signed DPA (Teams or Enterprise plan), SCCs in place, and a completed DPIA where required, Canva can be used for documents containing personal data. For documents containing special category data (Article 9 DSGVO) or confidential professional data, additional safeguards and legal assessment are recommended. Canva Enterprise customers can request data residency in specific regions. For Teams plan customers, data is processed across Canva's global infrastructure, including infrastructure in the United States. Standard Contractual Clauses cover this international transfer under the DPA. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Canva DPA: Yes, for Teams & Enterprise Plans", "description": "Canva provides a DPA for Teams and Enterprise plans. GDPR guide: AI training data opt-out, data residency, and sub-processor checks for Germany.", "image": "https://compound.law/assets/images/tools/tools_3.webp", "datePublished": "2026-04-05T00:00:00.000Z", "dateModified": "2026-04-05T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/canva-ai/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Canva DPA: Yes, for Teams & Enterprise Plans", "item": "https://compound.law/en-DE/tools/canva-ai/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does Canva have an AVV (Auftragsverarbeitungsvertrag)?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Canva provides a Data Processing Agreement — the equivalent of an Auftragsverarbeitungsvertrag under Article 28 DSGVO — for Teams and Enterprise customers. This must be signed before deploying Canva in any context that involves personal data." } }, { "@type": "Question", "name": "Is Canva GDPR compliant for German companies?", "acceptedAnswer": { "@type": "Answer", "text": "Canva can be used in a GDPR-compliant way on paid plans (Teams or Enterprise) with a signed DPA, Standard Contractual Clauses for international data transfers, and updated records of processing activities. The free Canva plan does not include a DPA and is not suitable for business use under GDPR." } }, { "@type": "Question", "name": "Does Canva use designs to train AI?", "acceptedAnswer": { "@type": "Answer", "text": "For Teams and Enterprise accounts, Canva states it does not use customer content to train AI models. For free plan accounts, content may be used for model improvement. Check the current Canva terms of service and privacy policy for the most up-to-date position, as these can change." } }, { "@type": "Question", "name": "Can I use Canva for sensitive business documents under GDPR?", "acceptedAnswer": { "@type": "Answer", "text": "With a signed DPA (Teams or Enterprise plan), SCCs in place, and a completed DPIA where required, Canva can be used for documents containing personal data. For documents containing special category data (Article 9 DSGVO) or confidential professional data, additional safeguards and legal assessment are recommended." } }, { "@type": "Question", "name": "Where is Canva data stored?", "acceptedAnswer": { "@type": "Answer", "text": "Canva Enterprise customers can request data residency in specific regions. For Teams plan customers, data is processed across Canva's global infrastructure, including infrastructure in the United States. Standard Contractual Clauses cover this international transfer under the DPA." } } ] } ] ```