Does Canva offer a DPA?

Yes. Canva offers a Data Processing Agreement, published as the Data Processing Addendum at canva.com/policies/data-processing-addendum/. It forms part of the Canva agreement, includes EU SCCs, and applies to paid plans such as Canva Teams and Canva Enterprise when Canva processes personal data as a processor.

• The Canva DPA is a public document — no login or signature required, unlike portal-gated vendor DPAs.
• It incorporates EU Standard Contractual Clauses (module two) governed by Irish law for restricted transfers.
• Subprocessor changes carry a 30-day notice period and a 10-day objection window — set an internal process.
• Annex 1.B states Canva does not intentionally process sensitive data, so Article 9 content stays your responsibility.

Yes — Canva offers a Data Processing Agreement. Canva publishes it as the Data Processing Addendum at canva.com/policies/data-processing-addendum/, where it forms part of the Canva agreement and applies automatically whenever Canva processes personal data as a processor for paid-plan customers such as Canva Teams and Canva Enterprise.

This page reviews the Canva DPA as a procurement document: what each clause covers, where it meets Article 28 GDPR, and where German companies need to add compliance work of their own. It provides general information, not legal advice for a specific situation. For the structured vendor-selection frame around this document, see our GDPR AI procurement guide; for the broader tool assessment, see our Canva AI review.

What the Canva DPA Covers: Clause-Level Index

Canva structures the DPA into twelve numbered sections plus annexes, and it maintains versioned archives of previous versions (the prior version is dated August 22, 2024). The table below maps the current clause structure so procurement and privacy teams can navigate the document quickly.

Clause	What it covers	Procurement note
§1 Definitions	”European Privacy Laws” defined to include the EU GDPR, UK GDPR, and Swiss FADP; SCCs defined as Commission Decision (EU) 2021/914	Confirms EU GDPR is directly addressed, not just US privacy law
§2.1 Relationship of the parties	Customer is the controller; Canva processes solely as processor on documented instructions	Standard Article 28(3) role allocation — your organisation stays the controller
§2.2 Purpose limitation	Processing only for the “Permitted Purpose”: providing the Service, performing the Agreement, and following documented instructions	Also contains US state privacy law no-sell/no-share commitments
§2.3–2.4 International transfers and SCCs	EU SCCs (module two, controller-to-processor) incorporated by reference for restricted transfers; UK Addendum and Swiss adaptations included	Clause 17, Option 1: SCCs governed by Irish law; Clause 18(b): Irish courts
§2.5 Confidentiality	Duty of confidentiality for all authorised persons, including staff and subcontractors	Matches Article 28(3)(b)
§2.6 Security	Technical and organisational measures set out in Annex 2, published at canva.com/policies/technical-and-organisational-measures/	Canva may update the TOMs by publication, without degrading overall security
§2.7 Subprocessing	30 days’ prior notice of subprocessor changes by posting at canva.com/policies/subprocessors/; objections to [email protected] within 10 days; termination right; flow-down terms with full Canva liability	The 10-day objection window is short — assign an owner before rollout
§2.8 Data subject rights	Reasonable and timely assistance with access, correction, objection, erasure, and portability requests	Matches Article 28(3)(e)
§2.9 DPIA assistance	Support for data protection impact assessments and regulator consultation	Supports Article 35 workflows
§2.10 Personal data breach	Notification without undue delay, plus cooperation on your reporting obligations	Supports Article 33 timelines
§2.11 Deletion	Destruction of customer personal data on termination or expiry, subject to legal retention duties	Matches Article 28(3)(g)
§2.12 Audit	Annual independent ISO 27001 audits; summary audit report on request; written audit questions once per year	Audit access is report-based, not on-site — note this for regulated sectors
Annexes	Annex I (parties, transfer description, supervisory authority), Annex 2 (TOMs), Annex 3 (sub-processors)	Annex 1.B states Canva does not intentionally collect or process sensitive data

Two details deserve attention when you review the document yourself. First, the SCC module selection is explicit: module two (controller-to-processor) applies, and the SCCs prevail over the main agreement in case of conflict. Second, Annex 1.C designates the supervisory authority of the EEA Member State where the customer is established — for German companies, that is regularly one of the German state data protection authorities (Datenschutzaufsichtsbehörden).

GDPR Procurement Guidance for the Canva DPA

The Canva DPA covers the contractual baseline, but procurement teams should read it against four practical questions.

Roles and instructions. Canva acts as processor, your organisation as controller. That allocation is only credible if you actually issue documented instructions: configure the workspace, define who may upload what, and record the processing purpose in your Article 30 register of processing activities.

International transfers. The SCCs are incorporated automatically, but the transfer analysis remains yours. Canva is headquartered in Australia and processes data on global infrastructure, so map which countries can receive data in your workflow, check the current subprocessor list, and document the transfer mechanism. For sensitive data categories, a Transfer Impact Assessment may be required even with SCCs in place.

Sensitive data. Annex 1.B states that Canva does not intentionally collect or process sensitive data — anything sensitive in your designs (photographs of identifiable people, health-related campaign material, HR documents) is determined and controlled by you. If Article 9 GDPR data flows through Canva, the DPA alone will not carry the justification; you need an Article 9(2) legal basis and regularly a DPIA.

AI training boundaries. For customers contracting under Canva’s Master Services Agreement, §1(i) states that Canva will not use Customer Material to train its AI models unless the customer administrator opts in. Verify the admin settings on your Teams or Enterprise workspace and document the configuration — see our Canva AI review for the plan-level detail.

One scoping note: Canva also publishes a separate Service Provider Data Processing Addendum for US state privacy law contexts. German buyers need the general Data Processing Addendum reviewed above — do not file the service-provider variant in your records by mistake.

Article 28 GDPR Checklist for the Canva DPA

Work through these steps before production use, and keep the evidence in your vendor management file:

1. Confirm role allocation. Record that Canva processes as processor under the DPA and that your organisation remains controller for the defined workflow.
2. Verify the Pflichtinhalte. Check each Article 28(3) element against the clause index above — instructions, confidentiality, security, subprocessors, data subject rights, breach notification, deletion, and audits are all addressed.
3. Document transfers. Record the SCC incorporation (module two, Irish law), the countries involved, and the transfer paths in your Article 30 register; run a Transfer Impact Assessment where data sensitivity warrants it.
4. Set up subprocessor monitoring. Subscribe to notifications per §2.7(a), calendar the 10-day objection window, and decide internally who assesses new subprocessors.
5. Close the gaps the DPA cannot. Establish your legal basis, complete a DPIA where required, involve the works council (Betriebsrat) for team-wide rollouts with usage analytics, and document AI feature configuration.

How to Obtain and Sign the Canva DPA

Canva’s DPA follows a public, self-executing model — a contrast worth knowing if you have dealt with portal-gated vendor DPAs. There is no login, no request form, and no countersignature: the DPA is supplementary to, and forms part of, the agreement governing your Canva use, so it applies automatically from the start of the subscription.

Four steps for your records:

1. Open the current DPA at canva.com/policies/data-processing-addendum/ and save a dated copy for your vendor file.
2. Record the version. Canva archives previous versions; note the access date and version in your records of processing activities.
3. Enterprise customers: if you contract under the Master Services Agreement, the DPA is referenced in its definitions (§12(h)) — request a PDF via your Canva sales representative if your file needs one. Note that Canva does not accept markups or edits to the MSA.
4. Activate notifications. Use the notification mechanism under §2.7(a) so subprocessor changes actually reach someone in your organisation.

Free-plan accounts are the exception: there is no DPA coverage that would support business processing of personal data, which is why our Canva AI review recommends paid plans for any professional use involving personal data.

Canva DPA Compared: How It Stacks Up for German Buyers

The table below summarises how the Canva DPA compares with peer vendor agreements as of October 2026. Verify current terms with each vendor before procurement decisions.

Feature	Canva	Claude (Anthropic)	Asana
DPA access path	Public web page, incorporated automatically	Incorporated into commercial terms, accessed via customer portal	Auto-included on all paid plans
SCCs for EU transfers	Yes — module two, Irish governing law	Yes — included with commercial terms	Yes — EU-to-US covered
Subprocessor objection	30 days’ notice, 10-day objection window	Subprocessor list with change notices	Public list, contractual objection right
Audit evidence	ISO 27001 summary report on request, annually	Documentation on request	Objection rights plus audit terms
Free plan covered	No	No (paid products only)	No

For German companies, all three vendors provide Article 28-compliant starting points. The decision drivers sit outside DPA existence: data residency (Canva offers residency options for Enterprise customers), the AI training boundary, audit expectations in your sector, and how well each tool’s workflow fits your data categories. Compare the Claude DPA and the Asana DPA in detail, and use our data processing agreement guide for the underlying Article 28 framework.

When the Canva DPA Is Not Enough

A signed (or incorporated) DPA is the entry ticket, not the finish line. A deeper legal review is regularly required where:

• designs or prompts contain Article 9 GDPR data — health, biometric, or similar special categories
• Canva is used across teams in ways that generate usage analytics or activity logs, triggering co-determination rights under § 87(1) No. 6 BetrVG
• your policy requires EU-only data residency as a hard guarantee rather than an Enterprise option
• the deployment must satisfy EU AI Act transparency or risk-management duties alongside GDPR
• sector-specific rules apply, for example in financial services, healthcare, or regulated advice

In these scenarios, the DPA is one exhibit in a larger file covering legal basis, processing architecture, transfer mechanism, and internal governance.

Compound Law advises businesses, founders, and in-house teams in Germany on GDPR compliance, commercial contracts, and AI procurement. If you want the Canva DPA — or another AI vendor agreement — reviewed before rollout, contact us.