Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers

Does Cursor offer a DPA under GDPR Art. 28?

Yes. Cursor (Anysphere) publishes its Data Processing Addendum publicly at cursor.com/terms/dpa. The Cursor DPA covers the Art. 28 GDPR processor framework, includes EU Standard Contractual Clauses and the UK Addendum, and prohibits submitting sensitive or special-category personal data.

• The Cursor DPA is public — no sales process or customer portal is needed to download it.
• It governs Anysphere's processing of personal data under the agreement between Anysphere and the customer.
• Transfer language covers EU SCCs and the UK Addendum; the subprocessor list sits on Cursor's trust portal.
• The DPA tells customers not to provide sensitive or special-category personal data under the agreement.

Yes — Cursor offers a Data Processing Addendum (DPA) under GDPR Art. 28, and Cursor publishes it openly at cursor.com/terms/dpa. The document governs how Anysphere, the company behind the Cursor AI code editor, processes personal data on behalf of its business customers. It includes EU Standard Contractual Clauses and the UK Addendum, and it draws a hard line on data categories: customers are told not to submit sensitive or special-category personal data under the agreement. For procurement teams, the practical question is no longer whether the Cursor DPA exists, but whether its clauses match your planned deployment in Germany.

This page is a document companion: it walks through the DPA clause by clause, maps it against the Art. 28 GDPR checklist, and shows how to fold it into a German procurement file. This page provides general information and is not legal advice for a specific deployment. For the broader vendor review, see our Cursor overview; for the German-language analysis, see Cursor AVV.

What the Cursor DPA covers: clause-level index

The Cursor DPA is a compact document, but it addresses the mandatory content of Art. 28 GDPR. Legal and privacy teams should verify each element against the actual deployment rather than treating the DPA as a checkbox:

DPA clause area	What the Cursor DPA provides	What to verify for your deployment
Scope of processing	Processing of personal data under the agreement between Anysphere and the customer	That your customer agreement and plan actually sit within this scope
Role allocation	Anysphere acts as processor for customer personal data	Document your own controller role in the Art. 30 register
Transfer mechanism	EU Standard Contractual Clauses and the UK Addendum	Countries involved, support access, and a transfer impact assessment where needed
Sensitive data	Express instruction that customers should not provide sensitive or special-category data	Confirm your workflow contains no Art. 9 GDPR material
Subprocessors	List published on Cursor’s trust portal, re-reviewed annually	Save the current list into the procurement file and review the chain
Data subject rights	Framework for supporting access, deletion, and correction requests	Your own response procedures remain your responsibility
Security and confidentiality	Security commitments aligned with Cursor’s published security documentation	Confirm the measures match your internal security requirements
Retention and deletion	Deletion behavior as described in Cursor’s Terms and Data Use documentation	Embeddings and metadata from codebase indexing deserve specific attention

Two clauses deserve special attention. First, the sensitive-data exclusion is unusually explicit for an AI vendor DPA: it signals that Cursor positions itself for ordinary business data, not for HR, health, or similarly sensitive material. Second, the transfer clauses combine EU SCCs with the UK Addendum in one document, which covers the two most common transfer scenarios but does not replace your own transfer documentation.

The DPA also interacts with Cursor’s product-level privacy features. Privacy Mode, which Cursor makes available on all plans including free and Pro, changes what happens to your data at the model-provider layer: Cursor states that with Privacy Mode enabled, customer data is not used for training and model providers do not store or train on it. Abuse-detection review and codebase-indexing embeddings remain exceptions to understand. The DPA and Privacy Mode are complements, not substitutes — the DPA frames the processor relationship, while Privacy Mode changes the data flow.

GDPR procurement guidance: reviewing the Cursor DPA in Germany

A German buyer should treat the Cursor DPA as the first document in a procurement file, not the last. The review that turns the DPA into a defensible deployment record has five steps:

1. Fix the contract path. The DPA governs processing under the agreement between Anysphere and the customer. Confirm which entity contracts with Anysphere, which plan the agreement covers, and that the subscription is a business agreement rather than an individual developer account.
2. Choose the plan that carries governance. Teams or Enterprise provides team-wide Privacy Mode enforcement, admin controls, SSO, and on Enterprise SCIM and audit logs. These features are what make the DPA’s allocations enforceable in practice.
3. Document transfers and subprocessors. Record that EU SCCs and the UK Addendum are the transfer basis, note the countries your data may reach, and archive the current subprocessor list from the trust portal with its review date.
4. Map data categories against the exclusion clause. List what will actually flow through Cursor — code, prompts, repository context, telemetry — and confirm none of it falls under the sensitive-data prohibition or under professional secrecy rules that apply to your sector.
5. Register the deployment. Enter the Cursor deployment in your Art. 30 record of processing activities, referencing the DPA version and date.

For the full procurement framework, including vendor assessment criteria and documentation templates, see our GDPR AI procurement guide. German-speaking teams will find the same framework in our KI-Beschaffung guide.

Art. 28 GDPR checklist for the Cursor DPA

Article 28(3) GDPR prescribes the minimum content of a processor agreement. Applied to the Cursor DPA, the checklist looks like this:

• Processing on documented instructions — the DPA binds Anysphere to process customer personal data under the customer agreement; your settings and usage rules are part of those instructions
• Confidentiality commitments — personnel handling customer data are subject to confidentiality obligations
• Security measures — cross-check the DPA against Cursor’s published security documentation and your own Art. 32 GDPR requirements
• Subprocessor regime — subprocessor list on the trust portal with annual re-review; check the objection mechanism for new subprocessors
• Data subject rights assistance — confirm the assistance duties cover your response workflows
• Deletion or return — confirm deletion behavior at contract end, including indexed embeddings and metadata
• Audit and information duties — verify how Cursor demonstrates compliance, and what documentation you can request
• Transfer safeguards — EU SCCs and UK Addendum present; transfer impact assessment completed for your data flows

If any checklist point cannot be answered from the DPA plus Cursor’s published documentation, ask the vendor in writing before rollout — written answers become part of the procurement record.

How to obtain and sign the Cursor DPA

Unlike vendors that embed their DPA in a customer portal, Cursor keeps the process public and ungated:

1. Download the DPA from cursor.com/terms/dpa and save the PDF or page version with the access date.
2. Confirm incorporation — check how the DPA attaches to your agreement: through the Terms of Service that apply when the business subscription is purchased, or through an Enterprise order form. The DPA references the customer agreement, so the subscription documents complete the chain.
3. Record the version — note the DPA version and date in your vendor management system and Art. 30 register, so you can detect changes at renewal.
4. Re-verify at renewal — AI vendors revise DPAs; a fresh download comparison takes minutes and keeps the file current.

Because the DPA is public, procurement can complete the legal review before any sales conversation — a meaningful speed advantage over vendors where the DPA only becomes available inside a portal or during contract negotiation. For comparison, the Anthropic DPA is incorporated into Anthropic’s commercial terms and accessed through the customer portal, while the Claude DPA structure and the Asana DPA show two further variants of how AI vendors document Art. 28 compliance.

When the Cursor DPA is not enough

The DPA answers the processor-contract question. It does not answer the deployment question. These obligations remain with you as the controller:

• Legal basis (Art. 6 GDPR) — the DPA never provides your legal basis for processing.
• Record of processing (Art. 30 GDPR) — you must document the deployment yourself.
• DPIA (Art. 35 GDPR) — large-scale or sensitive workflows may require a data protection impact assessment regardless of the DPA.
• Employee and works council questions — developer-tool rollouts can touch co-determination rights under section 87(1) no. 6 BetrVG where performance monitoring is involved.
• EU AI Act deployer duties — if Cursor-assisted code feeds a high-risk AI system, deployer obligations under the AI Act sit on top of GDPR compliance.

FAQ

Does Cursor offer a DPA under GDPR Art. 28?

Yes. Cursor, operated by Anysphere, publishes a Data Processing Addendum at cursor.com/terms/dpa that addresses the Art. 28 GDPR processor requirements. It covers processing under the customer agreement, includes EU SCCs and the UK Addendum, and sets confidentiality, subprocessor, and deletion frameworks. Whether it suffices for your rollout depends on plan, data categories, and workflow — which is why the clause-level review above matters.

Where can I download the Cursor DPA?

Directly at cursor.com/terms/dpa, with no gate or registration. Save the current version with its date into the procurement file, confirm how it attaches to your subscription documents, and re-download at renewal to catch revisions. Public availability means legal review can start before any vendor contact.

Does the Cursor DPA allow special-category personal data?

No. The DPA expressly asks customers not to provide sensitive or special-category personal data. Treat that as a planning constraint: HR files, health data, and comparable Art. 9 GDPR material need a different tool and a deeper legal review, not just a DPA signature.

Which transfer mechanism applies to Cursor data?

The Cursor DPA incorporates the EU Standard Contractual Clauses and the UK Addendum. German companies should document the transfer basis, identify which third countries can receive data, and review the subprocessor list on the trust portal. Where sensitivity or internal policy requires it, add a transfer impact assessment.

Which AI vendors provide DPAs suitable for German companies?

Anthropic (Claude), Asana, Azure OpenAI, DeepL, and Cursor all publish DPAs that address Art. 28 GDPR. They differ on EU data residency, retention, and special-category data handling. The right comparison set depends on your tool category — code editors, productivity platforms, or API models — and should be documented in the procurement file.

Do I need a paid Cursor plan for the DPA to work?

The DPA document is public regardless of plan, but a defensible company deployment needs the governance layer of Teams or Enterprise: team-wide Privacy Mode, admin controls, and SSO. Individual Pro accounts can enable Privacy Mode, yet they give procurement no central enforcement or audit trail.

Is the Cursor DPA the same as an AVV?

Functionally, yes — the English Data Processing Addendum corresponds to the German Auftragsverarbeitungsvertrag under Art. 28 GDPR. Because Anysphere publishes only English documents, German companies adopt the Cursor DPA as their AVV and reference it in their processing records. Our German-language companion page covers the AVV mapping in detail.

---

Compound Law advises businesses, startups, and in-house teams in Germany on AI procurement, DPA and AVV review, transfer assessments, and developer-tool governance. If you want us to review your Cursor deployment or another AI vendor contract before rollout, contact us.