--- title: "Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany" description: "Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/canva-dpa/" language: "en" --- ![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp) tools # Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany 27 October 2026 Does Canva offer a DPA? Yes. Canva offers a Data Processing Agreement, published as the Data Processing Addendum at canva.com/policies/data-processing-addendum/. It forms part of the Canva agreement, includes EU SCCs, and applies to paid plans such as Canva Teams and Canva Enterprise when Canva processes personal data as a processor. - The Canva DPA is a public document — no login or signature required, unlike portal-gated vendor DPAs. - It incorporates EU Standard Contractual Clauses (module two) governed by Irish law for restricted transfers. - Subprocessor changes carry a 30-day notice period and a 10-day objection window — set an internal process. - Annex 1.B states Canva does not intentionally process sensitive data, so Article 9 content stays your responsibility. Yes — Canva offers a Data Processing Agreement. Canva publishes it as the **Data Processing Addendum** at canva.com/policies/data-processing-addendum/, where it forms part of the Canva agreement and applies automatically whenever Canva processes personal data as a processor for paid-plan customers such as Canva Teams and Canva Enterprise. This page reviews the **Canva DPA** as a procurement document: what each clause covers, where it meets **Article 28 GDPR**, and where German companies need to add compliance work of their own. It provides general information, not legal advice for a specific situation. For the structured vendor-selection frame around this document, see our [GDPR AI procurement guide](https://compound.law/en-DE/compliance/gdpr-ai-procurement/); for the broader tool assessment, see our [Canva AI review](https://compound.law/en-DE/tools/canva-ai/). ## What the Canva DPA Covers: Clause-Level Index Canva structures the DPA into twelve numbered sections plus annexes, and it maintains versioned archives of previous versions (the prior version is dated August 22, 2024). The table below maps the current clause structure so procurement and privacy teams can navigate the document quickly. | Clause | What it covers | Procurement note | | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | | §1 Definitions | ”European Privacy Laws” defined to include the EU GDPR, UK GDPR, and Swiss FADP; SCCs defined as Commission Decision (EU) 2021/914 | Confirms EU GDPR is directly addressed, not just US privacy law | | §2.1 Relationship of the parties | Customer is the controller; Canva processes solely as processor on documented instructions | Standard Article 28(3) role allocation — your organisation stays the controller | | §2.2 Purpose limitation | Processing only for the “Permitted Purpose”: providing the Service, performing the Agreement, and following documented instructions | Also contains US state privacy law no-sell/no-share commitments | | §2.3–2.4 International transfers and SCCs | EU SCCs (module two, controller-to-processor) incorporated by reference for restricted transfers; UK Addendum and Swiss adaptations included | Clause 17, Option 1: SCCs governed by Irish law; Clause 18(b): Irish courts | | §2.5 Confidentiality | Duty of confidentiality for all authorised persons, including staff and subcontractors | Matches Article 28(3)(b) | | §2.6 Security | Technical and organisational measures set out in Annex 2, published at canva.com/policies/technical-and-organisational-measures/ | Canva may update the TOMs by publication, without degrading overall security | | §2.7 Subprocessing | 30 days’ prior notice of subprocessor changes by posting at canva.com/policies/subprocessors/; objections to within 10 days; termination right; flow-down terms with full Canva liability | The 10-day objection window is short — assign an owner before rollout | | §2.8 Data subject rights | Reasonable and timely assistance with access, correction, objection, erasure, and portability requests | Matches Article 28(3)(e) | | §2.9 DPIA assistance | Support for data protection impact assessments and regulator consultation | Supports Article 35 workflows | | §2.10 Personal data breach | Notification without undue delay, plus cooperation on your reporting obligations | Supports Article 33 timelines | | §2.11 Deletion | Destruction of customer personal data on termination or expiry, subject to legal retention duties | Matches Article 28(3)(g) | | §2.12 Audit | Annual independent ISO 27001 audits; summary audit report on request; written audit questions once per year | Audit access is report-based, not on-site — note this for regulated sectors | | Annexes | Annex I (parties, transfer description, supervisory authority), Annex 2 (TOMs), Annex 3 (sub-processors) | Annex 1.B states Canva does not intentionally collect or process sensitive data | Two details deserve attention when you review the document yourself. First, the SCC module selection is explicit: module two (controller-to-processor) applies, and the SCCs prevail over the main agreement in case of conflict. Second, Annex 1.C designates the supervisory authority of the EEA Member State where the customer is established — for German companies, that is regularly one of the German state data protection authorities (Datenschutzaufsichtsbehörden). ## GDPR Procurement Guidance for the Canva DPA The Canva DPA covers the contractual baseline, but procurement teams should read it against four practical questions. **Roles and instructions.** Canva acts as processor, your organisation as controller. That allocation is only credible if you actually issue documented instructions: configure the workspace, define who may upload what, and record the processing purpose in your Article 30 register of processing activities. **International transfers.** The SCCs are incorporated automatically, but the transfer analysis remains yours. Canva is headquartered in Australia and processes data on global infrastructure, so map which countries can receive data in your workflow, check the current [subprocessor list](https://www.canva.com/policies/subprocessors/), and document the transfer mechanism. For sensitive data categories, a Transfer Impact Assessment may be required even with SCCs in place. **Sensitive data.** Annex 1.B states that Canva does not intentionally collect or process sensitive data — anything sensitive in your designs (photographs of identifiable people, health-related campaign material, HR documents) is determined and controlled by you. If Article 9 GDPR data flows through Canva, the DPA alone will not carry the justification; you need an Article 9(2) legal basis and regularly a DPIA. **AI training boundaries.** For customers contracting under Canva’s Master Services Agreement, §1(i) states that Canva will not use Customer Material to train its AI models unless the customer administrator opts in. Verify the admin settings on your Teams or Enterprise workspace and document the configuration — see our [Canva AI review](https://compound.law/en-DE/tools/canva-ai/) for the plan-level detail. One scoping note: Canva also publishes a separate Service Provider Data Processing Addendum for US state privacy law contexts. German buyers need the general Data Processing Addendum reviewed above — do not file the service-provider variant in your records by mistake. ## Article 28 GDPR Checklist for the Canva DPA Work through these steps before production use, and keep the evidence in your vendor management file: 1. **Confirm role allocation.** Record that Canva processes as processor under the DPA and that your organisation remains controller for the defined workflow. 2. **Verify the Pflichtinhalte.** Check each Article 28(3) element against the clause index above — instructions, confidentiality, security, subprocessors, data subject rights, breach notification, deletion, and audits are all addressed. 3. **Document transfers.** Record the SCC incorporation (module two, Irish law), the countries involved, and the transfer paths in your Article 30 register; run a Transfer Impact Assessment where data sensitivity warrants it. 4. **Set up subprocessor monitoring.** Subscribe to notifications per §2.7(a), calendar the 10-day objection window, and decide internally who assesses new subprocessors. 5. **Close the gaps the DPA cannot.** Establish your legal basis, complete a DPIA where required, involve the works council (Betriebsrat) for team-wide rollouts with usage analytics, and document AI feature configuration. ## How to Obtain and Sign the Canva DPA Canva’s DPA follows a **public, self-executing model** — a contrast worth knowing if you have dealt with portal-gated vendor DPAs. There is no login, no request form, and no countersignature: the DPA is supplementary to, and forms part of, the agreement governing your Canva use, so it applies automatically from the start of the subscription. **Four steps for your records:** 1. **Open the current DPA** at [canva.com/policies/data-processing-addendum/](https://www.canva.com/policies/data-processing-addendum/) and save a dated copy for your vendor file. 2. **Record the version.** Canva archives previous versions; note the access date and version in your records of processing activities. 3. **Enterprise customers:** if you contract under the Master Services Agreement, the DPA is referenced in its definitions (§12(h)) — request a PDF via your Canva sales representative if your file needs one. Note that Canva does not accept markups or edits to the MSA. 4. **Activate notifications.** Use the notification mechanism under §2.7(a) so subprocessor changes actually reach someone in your organisation. Free-plan accounts are the exception: there is no DPA coverage that would support business processing of personal data, which is why our [Canva AI review](https://compound.law/en-DE/tools/canva-ai/) recommends paid plans for any professional use involving personal data. ## Canva DPA Compared: How It Stacks Up for German Buyers The table below summarises how the Canva DPA compares with peer vendor agreements as of October 2026. Verify current terms with each vendor before procurement decisions. | Feature | Canva | Claude (Anthropic) | Asana | | ---------------------- | --------------------------------------------- | ---------------------------------------------------------------- | ---------------------------------------- | | DPA access path | Public web page, incorporated automatically | Incorporated into commercial terms, accessed via customer portal | Auto-included on all paid plans | | SCCs for EU transfers | Yes — module two, Irish governing law | Yes — included with commercial terms | Yes — EU-to-US covered | | Subprocessor objection | 30 days’ notice, 10-day objection window | Subprocessor list with change notices | Public list, contractual objection right | | Audit evidence | ISO 27001 summary report on request, annually | Documentation on request | Objection rights plus audit terms | | Free plan covered | No | No (paid products only) | No | For German companies, all three vendors provide Article 28-compliant starting points. The decision drivers sit outside DPA existence: data residency (Canva offers residency options for Enterprise customers), the AI training boundary, audit expectations in your sector, and how well each tool’s workflow fits your data categories. Compare the [Claude DPA](https://compound.law/en-DE/tools/claude-dpa/) and the [Asana DPA](https://compound.law/en-DE/tools/asana-dpa/) in detail, and use our [data processing agreement guide](https://compound.law/en-DE/compliance/data-processing-agreement/) for the underlying Article 28 framework. ## When the Canva DPA Is Not Enough A signed (or incorporated) DPA is the entry ticket, not the finish line. A deeper legal review is regularly required where: - designs or prompts contain **Article 9 GDPR data** — health, biometric, or similar special categories - Canva is used across teams in ways that generate **usage analytics or activity logs**, triggering co-determination rights under **§ 87(1) No. 6 BetrVG** - your policy requires **EU-only data residency** as a hard guarantee rather than an Enterprise option - the deployment must satisfy **EU AI Act** transparency or risk-management duties alongside GDPR - sector-specific rules apply, for example in financial services, healthcare, or regulated advice In these scenarios, the DPA is one exhibit in a larger file covering legal basis, processing architecture, transfer mechanism, and internal governance. Compound Law advises businesses, founders, and in-house teams in Germany on **GDPR compliance, commercial contracts, and AI procurement**. If you want the Canva DPA — or another AI vendor agreement — reviewed before rollout, [contact us](https://compound.law/en-DE/#booking). ## Related Tool Guides [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) [![Claude ZDR zero data retention guide for Anthropic API and Claude Code enterprise use](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-zdr/) [tools](https://compound.law/en-DE/tools/claude-zdr/) ### [Claude ZDR: What It Covers, Who Qualifies, How to Get It](https://compound.law/en-DE/tools/claude-zdr/) [Claude ZDR is available for the Anthropic API and Claude Code. See which plans qualify, what's excluded, and how to request enablement for your organization.](https://compound.law/en-DE/tools/claude-zdr/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) - [Claude Team Plan DPA & GDPR Compliance Guide tools](https://compound.law/en-DE/tools/claude-team-gdpr/) ## Frequently asked questions Yes. Canva provides a Data Processing Agreement, published as the Data Processing Addendum at canva.com/policies/data-processing-addendum/. It forms part of the Canva agreement and applies automatically when Canva processes personal data as a processor. It covers paid plans such as Canva Teams and Canva Enterprise; the free plan is not a reliable basis for processing personal data. In principle, yes. The Canva DPA addresses the mandatory Article 28(3) content: instructions, confidentiality, security, subprocessors, data subject rights, breach notification, deletion, and audits. Sufficiency for your deployment depends on whether roles, data categories, transfer paths, and subprocessors are correctly mapped to your actual Canva workflow. No. The Canva DPA is supplementary to, and forms part of, the agreement governing your Canva use — it is incorporated automatically rather than countersigned. What you should do instead is download the current version, record the version and date in your vendor register, and subscribe to subprocessor change notifications. The SCCs incorporated in the Canva DPA are governed by Irish law, with disputes before the Irish courts (Clause 17, Option 1 and Clause 18(b)). For enterprise customers in Europe contracting under Canva's Master Services Agreement, the main agreement is governed by the laws of England and Wales. The DPA prevails over the main agreement to the extent of any conflict. No. The DPA practice described here sits with the paid plans — Canva Teams and Canva Enterprise. Free-plan accounts are not covered by a DPA in a way that would support business processing of personal data, so the free plan is not suitable for professional use involving personal data. This mirrors the pattern at other vendors such as Anthropic. The Canva DPA is available as a public web page at canva.com/policies/data-processing-addendum/ — no login required. Canva maintains versioned archives of previous DPA versions, and the subprocessor list and technical and organisational measures are published on adjacent policy pages. Enterprise customers contracting under the MSA can request a PDF copy from their Canva sales representative. Several AI vendors publish DPAs that work for German deployments, including Canva, Anthropic (Claude), OpenAI, and Asana. The differentiators are rarely DPA existence but data residency options, subprocessor objection rights, audit access, and AI training exclusions. Compare the Canva DPA with the Claude DPA and the Asana DPA before deciding, and document the comparison in your procurement file. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany", "description": "Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.", "image": "https://compound.law/assets/images/tools/tools_3.webp", "datePublished": "2026-10-27T00:00:00.000Z", "dateModified": "2026-10-27T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/canva-dpa/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany", "item": "https://compound.law/en-DE/tools/canva-dpa/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does Canva offer a DPA?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Canva provides a Data Processing Agreement, published as the Data Processing Addendum at canva.com/policies/data-processing-addendum/. It forms part of the Canva agreement and applies automatically when Canva processes personal data as a processor. It covers paid plans such as Canva Teams and Canva Enterprise; the free plan is not a reliable basis for processing personal data." } }, { "@type": "Question", "name": "Is the Canva DPA sufficient for Article 28 GDPR?", "acceptedAnswer": { "@type": "Answer", "text": "In principle, yes. The Canva DPA addresses the mandatory Article 28(3) content: instructions, confidentiality, security, subprocessors, data subject rights, breach notification, deletion, and audits. Sufficiency for your deployment depends on whether roles, data categories, transfer paths, and subprocessors are correctly mapped to your actual Canva workflow." } }, { "@type": "Question", "name": "Do I need to sign the Canva DPA?", "acceptedAnswer": { "@type": "Answer", "text": "No. The Canva DPA is supplementary to, and forms part of, the agreement governing your Canva use — it is incorporated automatically rather than countersigned. What you should do instead is download the current version, record the version and date in your vendor register, and subscribe to subprocessor change notifications." } }, { "@type": "Question", "name": "Which law governs the Canva DPA?", "acceptedAnswer": { "@type": "Answer", "text": "The SCCs incorporated in the Canva DPA are governed by Irish law, with disputes before the Irish courts (Clause 17, Option 1 and Clause 18(b)). For enterprise customers in Europe contracting under Canva's Master Services Agreement, the main agreement is governed by the laws of England and Wales. The DPA prevails over the main agreement to the extent of any conflict." } }, { "@type": "Question", "name": "Does the Canva DPA cover the free plan?", "acceptedAnswer": { "@type": "Answer", "text": "No. The DPA practice described here sits with the paid plans — Canva Teams and Canva Enterprise. Free-plan accounts are not covered by a DPA in a way that would support business processing of personal data, so the free plan is not suitable for professional use involving personal data. This mirrors the pattern at other vendors such as Anthropic." } }, { "@type": "Question", "name": "Where can I download the Canva DPA?", "acceptedAnswer": { "@type": "Answer", "text": "The Canva DPA is available as a public web page at canva.com/policies/data-processing-addendum/ — no login required. Canva maintains versioned archives of previous DPA versions, and the subprocessor list and technical and organisational measures are published on adjacent policy pages. Enterprise customers contracting under the MSA can request a PDF copy from their Canva sales representative." } }, { "@type": "Question", "name": "Which AI vendors provide DPAs suitable for German companies?", "acceptedAnswer": { "@type": "Answer", "text": "Several AI vendors publish DPAs that work for German deployments, including Canva, Anthropic (Claude), OpenAI, and Asana. The differentiators are rarely DPA existence but data residency options, subprocessor objection rights, audit access, and AI training exclusions. Compare the Canva DPA with the Claude DPA and the Asana DPA before deciding, and document the comparison in your procurement file." } } ] } ] ```