--- title: "Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers" description: "Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/cursor-dpa/" language: "en" --- ![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp) tools # Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers 27 October 2026 Does Cursor offer a DPA under GDPR Art. 28? Yes. Cursor (Anysphere) publishes its Data Processing Addendum publicly at cursor.com/terms/dpa. The Cursor DPA covers the Art. 28 GDPR processor framework, includes EU Standard Contractual Clauses and the UK Addendum, and prohibits submitting sensitive or special-category personal data. - The Cursor DPA is public — no sales process or customer portal is needed to download it. - It governs Anysphere's processing of personal data under the agreement between Anysphere and the customer. - Transfer language covers EU SCCs and the UK Addendum; the subprocessor list sits on Cursor's trust portal. - The DPA tells customers not to provide sensitive or special-category personal data under the agreement. **Yes — Cursor offers a Data Processing Addendum (DPA) under GDPR Art. 28, and Cursor publishes it openly at `cursor.com/terms/dpa`.** The document governs how **Anysphere**, the company behind the Cursor AI code editor, processes personal data on behalf of its business customers. It includes **EU Standard Contractual Clauses** and the **UK Addendum**, and it draws a hard line on data categories: customers are told not to submit sensitive or special-category personal data under the agreement. For procurement teams, the practical question is no longer whether the Cursor DPA exists, but whether its clauses match your planned deployment in Germany. This page is a document companion: it walks through the DPA clause by clause, maps it against the Art. 28 GDPR checklist, and shows how to fold it into a German procurement file. This page provides general information and is not legal advice for a specific deployment. For the broader vendor review, see our [Cursor overview](https://compound.law/en-DE/tools/cursor/); for the German-language analysis, see [Cursor AVV](https://compound.law/de-DE/tools/cursor-avv/). ## What the Cursor DPA covers: clause-level index The Cursor DPA is a compact document, but it addresses the mandatory content of **Art. 28 GDPR**. Legal and privacy teams should verify each element against the actual deployment rather than treating the DPA as a checkbox: | DPA clause area | What the Cursor DPA provides | What to verify for your deployment | | ---------------------------- | ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | | Scope of processing | Processing of personal data under the agreement between Anysphere and the customer | That your customer agreement and plan actually sit within this scope | | Role allocation | Anysphere acts as processor for customer personal data | Document your own controller role in the Art. 30 register | | Transfer mechanism | EU Standard Contractual Clauses and the UK Addendum | Countries involved, support access, and a transfer impact assessment where needed | | Sensitive data | Express instruction that customers should not provide sensitive or special-category data | Confirm your workflow contains no Art. 9 GDPR material | | Subprocessors | List published on Cursor’s trust portal, re-reviewed annually | Save the current list into the procurement file and review the chain | | Data subject rights | Framework for supporting access, deletion, and correction requests | Your own response procedures remain your responsibility | | Security and confidentiality | Security commitments aligned with Cursor’s published security documentation | Confirm the measures match your internal security requirements | | Retention and deletion | Deletion behavior as described in Cursor’s Terms and Data Use documentation | Embeddings and metadata from codebase indexing deserve specific attention | Two clauses deserve special attention. First, the **sensitive-data exclusion** is unusually explicit for an AI vendor DPA: it signals that Cursor positions itself for ordinary business data, not for HR, health, or similarly sensitive material. Second, the **transfer clauses** combine EU SCCs with the UK Addendum in one document, which covers the two most common transfer scenarios but does not replace your own transfer documentation. The DPA also interacts with Cursor’s product-level privacy features. **Privacy Mode**, which Cursor makes available on all plans including free and Pro, changes what happens to your data at the model-provider layer: Cursor states that with Privacy Mode enabled, customer data is not used for training and model providers do not store or train on it. Abuse-detection review and codebase-indexing embeddings remain exceptions to understand. The DPA and Privacy Mode are complements, not substitutes — the DPA frames the processor relationship, while Privacy Mode changes the data flow. ## GDPR procurement guidance: reviewing the Cursor DPA in Germany A German buyer should treat the Cursor DPA as the first document in a procurement file, not the last. The review that turns the DPA into a defensible deployment record has five steps: 1. **Fix the contract path.** The DPA governs processing under the agreement between Anysphere and the customer. Confirm which entity contracts with Anysphere, which plan the agreement covers, and that the subscription is a business agreement rather than an individual developer account. 2. **Choose the plan that carries governance.** Teams or Enterprise provides team-wide Privacy Mode enforcement, admin controls, SSO, and on Enterprise SCIM and audit logs. These features are what make the DPA’s allocations enforceable in practice. 3. **Document transfers and subprocessors.** Record that EU SCCs and the UK Addendum are the transfer basis, note the countries your data may reach, and archive the current subprocessor list from the trust portal with its review date. 4. **Map data categories against the exclusion clause.** List what will actually flow through Cursor — code, prompts, repository context, telemetry — and confirm none of it falls under the sensitive-data prohibition or under professional secrecy rules that apply to your sector. 5. **Register the deployment.** Enter the Cursor deployment in your Art. 30 record of processing activities, referencing the DPA version and date. For the full procurement framework, including vendor assessment criteria and documentation templates, see our [GDPR AI procurement guide](https://compound.law/en-DE/compliance/gdpr-ai-procurement/). German-speaking teams will find the same framework in our [KI-Beschaffung guide](https://compound.law/de-DE/compliance/dsgvo-ki-beschaffung/). ## Art. 28 GDPR checklist for the Cursor DPA Article 28(3) GDPR prescribes the minimum content of a processor agreement. Applied to the Cursor DPA, the checklist looks like this: - [ ] **Processing on documented instructions** — the DPA binds Anysphere to process customer personal data under the customer agreement; your settings and usage rules are part of those instructions - [ ] **Confidentiality commitments** — personnel handling customer data are subject to confidentiality obligations - [ ] **Security measures** — cross-check the DPA against Cursor’s published security documentation and your own Art. 32 GDPR requirements - [ ] **Subprocessor regime** — subprocessor list on the trust portal with annual re-review; check the objection mechanism for new subprocessors - [ ] **Data subject rights assistance** — confirm the assistance duties cover your response workflows - [ ] **Deletion or return** — confirm deletion behavior at contract end, including indexed embeddings and metadata - [ ] **Audit and information duties** — verify how Cursor demonstrates compliance, and what documentation you can request - [ ] **Transfer safeguards** — EU SCCs and UK Addendum present; transfer impact assessment completed for your data flows If any checklist point cannot be answered from the DPA plus Cursor’s published documentation, ask the vendor in writing before rollout — written answers become part of the procurement record. ## How to obtain and sign the Cursor DPA Unlike vendors that embed their DPA in a customer portal, Cursor keeps the process **public and ungated**: 1. **Download the DPA** from `cursor.com/terms/dpa` and save the PDF or page version with the access date. 2. **Confirm incorporation** — check how the DPA attaches to your agreement: through the Terms of Service that apply when the business subscription is purchased, or through an Enterprise order form. The DPA references the customer agreement, so the subscription documents complete the chain. 3. **Record the version** — note the DPA version and date in your vendor management system and Art. 30 register, so you can detect changes at renewal. 4. **Re-verify at renewal** — AI vendors revise DPAs; a fresh download comparison takes minutes and keeps the file current. Because the DPA is public, procurement can complete the legal review **before** any sales conversation — a meaningful speed advantage over vendors where the DPA only becomes available inside a portal or during contract negotiation. For comparison, the [Anthropic DPA](https://compound.law/en-DE/tools/anthropic-dpa/) is incorporated into Anthropic’s commercial terms and accessed through the customer portal, while the [Claude DPA structure](https://compound.law/en-DE/tools/claude-dpa/) and the [Asana DPA](https://compound.law/en-DE/tools/asana-dpa/) show two further variants of how AI vendors document Art. 28 compliance. ## When the Cursor DPA is not enough The DPA answers the processor-contract question. It does not answer the deployment question. These obligations remain with you as the controller: - **Legal basis (Art. 6 GDPR)** — the DPA never provides your legal basis for processing. - **Record of processing (Art. 30 GDPR)** — you must document the deployment yourself. - **DPIA (Art. 35 GDPR)** — large-scale or sensitive workflows may require a data protection impact assessment regardless of the DPA. - **Employee and works council questions** — developer-tool rollouts can touch co-determination rights under section 87(1) no. 6 BetrVG where performance monitoring is involved. - **EU AI Act deployer duties** — if Cursor-assisted code feeds a high-risk AI system, deployer obligations under the AI Act sit on top of GDPR compliance. ## FAQ ### Does Cursor offer a DPA under GDPR Art. 28? Yes. Cursor, operated by Anysphere, publishes a Data Processing Addendum at cursor.com/terms/dpa that addresses the Art. 28 GDPR processor requirements. It covers processing under the customer agreement, includes EU SCCs and the UK Addendum, and sets confidentiality, subprocessor, and deletion frameworks. Whether it suffices for your rollout depends on plan, data categories, and workflow — which is why the clause-level review above matters. ### Where can I download the Cursor DPA? Directly at cursor.com/terms/dpa, with no gate or registration. Save the current version with its date into the procurement file, confirm how it attaches to your subscription documents, and re-download at renewal to catch revisions. Public availability means legal review can start before any vendor contact. ### Does the Cursor DPA allow special-category personal data? No. The DPA expressly asks customers not to provide sensitive or special-category personal data. Treat that as a planning constraint: HR files, health data, and comparable Art. 9 GDPR material need a different tool and a deeper legal review, not just a DPA signature. ### Which transfer mechanism applies to Cursor data? The Cursor DPA incorporates the EU Standard Contractual Clauses and the UK Addendum. German companies should document the transfer basis, identify which third countries can receive data, and review the subprocessor list on the trust portal. Where sensitivity or internal policy requires it, add a transfer impact assessment. ### Which AI vendors provide DPAs suitable for German companies? Anthropic (Claude), Asana, Azure OpenAI, DeepL, and Cursor all publish DPAs that address Art. 28 GDPR. They differ on EU data residency, retention, and special-category data handling. The right comparison set depends on your tool category — code editors, productivity platforms, or API models — and should be documented in the procurement file. ### Do I need a paid Cursor plan for the DPA to work? The DPA document is public regardless of plan, but a defensible company deployment needs the governance layer of Teams or Enterprise: team-wide Privacy Mode, admin controls, and SSO. Individual Pro accounts can enable Privacy Mode, yet they give procurement no central enforcement or audit trail. ### Is the Cursor DPA the same as an AVV? Functionally, yes — the English Data Processing Addendum corresponds to the German Auftragsverarbeitungsvertrag under Art. 28 GDPR. Because Anysphere publishes only English documents, German companies adopt the Cursor DPA as their AVV and reference it in their processing records. Our German-language companion page covers the AVV mapping in detail. *** Compound Law advises businesses, startups, and in-house teams in Germany on **AI procurement, DPA and AVV review, transfer assessments, and developer-tool governance**. If you want us to review your Cursor deployment or another AI vendor contract before rollout, [contact us](https://compound.law/en-DE/#booking). ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) [![Claude ZDR zero data retention guide for Anthropic API and Claude Code enterprise use](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-zdr/) [tools](https://compound.law/en-DE/tools/claude-zdr/) ### [Claude ZDR: What It Covers, Who Qualifies, How to Get It](https://compound.law/en-DE/tools/claude-zdr/) [Claude ZDR is available for the Anthropic API and Claude Code. See which plans qualify, what's excluded, and how to request enablement for your organization.](https://compound.law/en-DE/tools/claude-zdr/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) - [Claude Team Plan DPA & GDPR Compliance Guide tools](https://compound.law/en-DE/tools/claude-team-gdpr/) ## Frequently asked questions Yes. Cursor, the AI code editor operated by Anysphere, publishes a Data Processing Addendum that addresses the Art. 28 GDPR processor requirements. It governs Anysphere's processing on behalf of the customer and includes EU Standard Contractual Clauses plus the UK Addendum. Whether it suffices for your deployment depends on plan, data types, and workflow. The Cursor DPA is available as a public download at cursor.com/terms/dpa. No sales contact, gated form, or customer portal is required, which makes procurement review straightforward. Teams should save the current version with its date into the procurement file and re-check it at renewal, since AI vendors revise these documents. No. The public DPA states that customers should not provide sensitive or special-category personal data under the agreement. German teams should read this as a clear boundary: HR records, health data, and similar Article 9 GDPR material do not belong in Cursor workflows without a separate, deeper legal review. The DPA includes EU Standard Contractual Clauses (SCCs) and the UK Addendum as its transfer language. For German companies this is the starting point for third-country transfers, but the company must still document the countries involved, review the subprocessor chain on the trust portal, and assess whether the workflow fits that transfer setup. The DPA references the agreement between Anysphere and the customer, and the document itself is public at any plan level. For a company rollout, Teams or Enterprise is the realistic baseline, because team-wide Privacy Mode enforcement, admin controls, and SSO only exist there. Free and Pro accounts can enable Privacy Mode individually but lack governance features. Most enterprise-relevant AI vendors publish GDPR-compliant DPAs, including Anthropic for Claude, Asana, Azure OpenAI, DeepL, and Cursor. The differentiators for German buyers are EU data residency, retention behavior, and special-category data handling. Compare the Cursor DPA against the Anthropic and Asana DPAs and document the comparison in the procurement file. Functionally yes. A Data Processing Addendum is the English-law term for what German data protection law calls an Auftragsverarbeitungsvertrag (AVV) under Art. 28 GDPR. Anysphere publishes only English-language contract documents, so German companies use the Cursor DPA as their AVV and map its clauses into their own processing records and vendor documentation. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers", "description": "Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.", "image": "https://compound.law/assets/images/tools/tools_1.webp", "datePublished": "2026-10-27T00:00:00.000Z", "dateModified": "2026-10-27T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/cursor-dpa/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers", "item": "https://compound.law/en-DE/tools/cursor-dpa/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does Cursor offer a DPA under GDPR Art. 28?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Cursor, the AI code editor operated by Anysphere, publishes a Data Processing Addendum that addresses the Art. 28 GDPR processor requirements. It governs Anysphere's processing on behalf of the customer and includes EU Standard Contractual Clauses plus the UK Addendum. Whether it suffices for your deployment depends on plan, data types, and workflow." } }, { "@type": "Question", "name": "Where can I download the Cursor DPA?", "acceptedAnswer": { "@type": "Answer", "text": "The Cursor DPA is available as a public download at cursor.com/terms/dpa. No sales contact, gated form, or customer portal is required, which makes procurement review straightforward. Teams should save the current version with its date into the procurement file and re-check it at renewal, since AI vendors revise these documents." } }, { "@type": "Question", "name": "Does the Cursor DPA cover special-category personal data?", "acceptedAnswer": { "@type": "Answer", "text": "No. The public DPA states that customers should not provide sensitive or special-category personal data under the agreement. German teams should read this as a clear boundary: HR records, health data, and similar Article 9 GDPR material do not belong in Cursor workflows without a separate, deeper legal review." } }, { "@type": "Question", "name": "What transfer mechanism does the Cursor DPA use?", "acceptedAnswer": { "@type": "Answer", "text": "The DPA includes EU Standard Contractual Clauses (SCCs) and the UK Addendum as its transfer language. For German companies this is the starting point for third-country transfers, but the company must still document the countries involved, review the subprocessor chain on the trust portal, and assess whether the workflow fits that transfer setup." } }, { "@type": "Question", "name": "Which Cursor plan do I need for the DPA?", "acceptedAnswer": { "@type": "Answer", "text": "The DPA references the agreement between Anysphere and the customer, and the document itself is public at any plan level. For a company rollout, Teams or Enterprise is the realistic baseline, because team-wide Privacy Mode enforcement, admin controls, and SSO only exist there. Free and Pro accounts can enable Privacy Mode individually but lack governance features." } }, { "@type": "Question", "name": "Which AI vendors provide DPAs suitable for German companies?", "acceptedAnswer": { "@type": "Answer", "text": "Most enterprise-relevant AI vendors publish GDPR-compliant DPAs, including Anthropic for Claude, Asana, Azure OpenAI, DeepL, and Cursor. The differentiators for German buyers are EU data residency, retention behavior, and special-category data handling. Compare the Cursor DPA against the Anthropic and Asana DPAs and document the comparison in the procurement file." } }, { "@type": "Question", "name": "Is the Cursor DPA the same as a German AVV?", "acceptedAnswer": { "@type": "Answer", "text": "Functionally yes. A Data Processing Addendum is the English-law term for what German data protection law calls an Auftragsverarbeitungsvertrag (AVV) under Art. 28 GDPR. Anysphere publishes only English-language contract documents, so German companies use the Cursor DPA as their AVV and map its clauses into their own processing records and vendor documentation." } } ] } ] ```