--- title: "Cursor DPA: Where to Find It and Which Plan German Teams Need" description: "Cursor publishes its DPA at cursor.com/terms/dpa — but the GDPR-safe baseline for German teams is Teams or Enterprise, Privacy Mode, plus SCC transfer review." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/cursor/" language: "en" --- ![Cursor DPA and GDPR review for teams in Germany](https://compound.law/assets/images/tools/tools_2.webp) tools # Cursor DPA: Where to Find It and Which Plan German Teams Need 29 June 2026 Where is the Cursor DPA and which plan fits Germany? Cursor publishes its Data Processing Addendum at cursor.com/terms/dpa. For German business use, the practical baseline is usually Teams or Enterprise, because the DPA still needs a company contract path, team-wide Privacy Mode, transfer review, and admin controls before personal data can be handled safely. - The public Cursor DPA references the agreement between Anysphere and the customer and includes SCC language for EU and UK transfers. - Privacy Mode is available on free and Pro accounts, but team-wide enforcement and admin controls sit on Teams and Enterprise. - The DPA says customers should not provide sensitive or special-category personal data under the agreement. - German teams still need an internal policy for source code, prompts, telemetry, and subprocessor review. **Yes — Cursor publishes its DPA publicly at `cursor.com/terms/dpa`, and the current 2026 answer for German buyers is this: use Teams or Enterprise for a real company rollout, enable Privacy Mode, and treat the DPA as only one part of the GDPR file.** Cursor now makes **Privacy Mode** available broadly, including free and Pro accounts, but the practical procurement baseline for businesses is still the plans with team-wide controls, centralized administration, and a clearer contractual path. If you need the Article 28 framework first, also see our guide to [data processing agreements under GDPR](https://compound.law/en-DE/compliance/data-processing-agreement/). For the engineering-governance layer, see [AI code generation compliance](https://compound.law/en-DE/compliance/ai-code-generation/) and our comparison pages for [GitHub Copilot](https://compound.law/en-DE/tools/copilot-github/) and [Replit](https://compound.law/en-DE/tools/replit/). This page provides general legal information, not legal advice for a specific deployment. The legal result depends on your plan, settings, data types, and workflow. ## Where to find the Cursor DPA Cursor publishes its **Data Processing Addendum (DPA)** publicly at `cursor.com/terms/dpa`. That is useful because a German procurement team can review the contract text before rollout rather than waiting for a sales process. The more important legal detail is what the DPA says about scope: - it governs Anysphere’s processing of personal data under the agreement between Anysphere and the customer - it includes transfer language for **EU SCCs** and the **UK Addendum** - it says customers should **not provide sensitive or special-category personal data** under the agreement That last point matters. If your intended workflow includes HR files, health data, criminal-offence data, or similarly sensitive material, the public DPA already signals that Cursor is not the routine default channel. For a clause-by-clause walkthrough of the DPA text against the Art. 28 GDPR checklist, see our dedicated [Cursor DPA guide](https://compound.law/en-DE/tools/cursor-dpa/). ## Which Cursor plan is the realistic GDPR starting point? Cursor’s public pricing as of **June 29, 2026** lists **Hobby**, **Pro**, **Teams**, and **Enterprise**. Cursor’s Security page says Privacy Mode is available to anyone, including free and Pro users. That does **not** mean all plans are equally suitable for company use. Our legal assessment is: | Plan | What Cursor says publicly | Practical GDPR view for Germany | | ---------- | ---------------------------------------------------------------------------- | -------------------------------------------------------------------------- | | Hobby | Free plan with limited usage | Not a serious basis for company personal-data workflows | | Pro | Individual paid plan; Privacy Mode available | Can fit solo low-risk use, but weak for company governance and procurement | | Teams | Team billing, admin, analytics, SSO, and team-wide Privacy Mode | Best default starting point for most German startups and software teams | | Enterprise | Adds pooled usage, SCIM, access controls, audit logs, and account management | Better fit for larger or more regulated organizations | That conclusion is partly an inference from Cursor’s public plan pages and admin features. The key point is practical rather than semantic: a company needs a plan that lets it enforce settings, document responsibility, and govern a team rollout. ## What Privacy Mode changes in 2026 Cursor’s current public materials are clearer than they used to be. The **Terms of Service** say Anysphere will not use content to train models unless the customer explicitly agrees. The **Security** page says Privacy Mode can be enabled in settings or by a team or enterprise admin and is available to anyone. The **Data Use & Privacy Overview** adds that, when Privacy Mode is enabled, Cursor states that customer data will not be used for training and that its model providers will not store or train on that data. That is a meaningful improvement, but it is not the end of the legal analysis. Cursor also says: - prompts or conversations that trigger abuse detection may still be stored for investigation - non-ZDR models may require admin opt-in or be marked separately - requests still go through Cursor’s backend, even when you use your own API key - codebase indexing uploads code in chunks to compute embeddings, while embeddings and metadata may remain stored For German teams, that means **Privacy Mode reduces risk, but does not erase transfer, retention, or governance questions**. ## What the Cursor DPA does and does not solve The DPA helps with the classic **Article 28 GDPR** processor-contract question. It gives you a contractual baseline, SCC language, and some structure for data subject rights, security, and subprocessor obligations. It does **not** solve these points on its own: - whether your chosen plan actually gives your organization the right contractual setup - whether your developers are sending unnecessary source code, client data, or secrets into prompts - whether your internal documentation properly records transfers, subprocessors, and retention assumptions - whether your workflow involves data that the DPA itself discourages or excludes in practice If your review is mainly contractual, the DPA is the first document. If your review is operational, the real work starts after that document is downloaded. ## Cursor plan comparison for data handling For legal and procurement teams, the operational differences matter more than the marketing labels. | Plan | Privacy Mode | Admin controls | Recommended use case | | ---------- | ---------------------- | ----------------------------------------------------- | -------------------------------------- | | Hobby | Available | None worth relying on for a team | Personal testing only | | Pro | Available | Individual settings only | Solo developer, low-risk internal work | | Teams | Team-wide Privacy Mode | Team admin, billing, analytics, SSO | Standard company rollout | | Enterprise | Team-wide Privacy Mode | SCIM, access controls, audit logs, account management | Regulated or scaled rollout | This is why many German buyers asking for the **Cursor DPA** are really asking a broader question: “Which Cursor plan lets us defend the deployment if legal, security, or a customer asks later?” In most cases, that answer starts at **Teams**. ## Source code, telemetry, and confidentiality The main legal risk is not whether Cursor has a DPA PDF-equivalent. The main risk is **what leaves the development environment**. Teams should assume the relevant exposure points include: - prompts entered by developers - code snippets and surrounding repository context - embeddings and metadata generated during indexing - usage analytics and admin-visible activity data That drives the internal policy question. Before rollout, a German company should define at least these rules: 1. no raw customer datasets, HR files, or support logs in Cursor by default 2. no secrets, keys, tokens, or incident data in prompts 3. no routine use for Article 9 GDPR data or professional-secrecy material 4. human review before AI-generated code is merged into production If the team cannot keep those boundaries in practice, Cursor is the wrong default tool for that workflow. ## Transfers, subprocessors, and Germany-specific review Cursor’s Security page says its list of subprocessors is published on the trust portal and re-reviewed annually. That is helpful, but German buyers still need to save the current list into the procurement file and assess whether the vendor chain is acceptable for the intended use. The minimum review usually covers: - the current DPA version and date - the current subprocessor list - the transfer mechanism and countries involved - the chosen Privacy Mode configuration - the internal rule set for allowed and prohibited use For many startups and software teams, that package can be enough for low-risk internal coding support. For **client-confidential**, **employment**, **regulated-sector**, or **public-sector** use, additional review is usually required. For a broader procurement checklist, see our [GDPR AI vendor assessment checklist](https://compound.law/en-DE/compliance/gdpr-ai-vendor-assessment-checklist/) and our [GDPR AI procurement guide](https://compound.law/en-DE/compliance/gdpr-ai-procurement/). ## Our assessment **Cursor’s DPA is real, public, and useful, but it is not a one-click answer to GDPR compliance.** The 2026 improvement is that Cursor now states more clearly where the DPA lives, how Privacy Mode changes training and retention, and which team controls sit on Teams and Enterprise. For German companies, the safer position is to treat **Teams** as the minimum normal rollout plan and **Enterprise** as the stronger option where auditability, access control, or regulated workflows matter. If your question is only “Does Cursor have a DPA?” the answer is **yes**. If your question is “Can we now use Cursor for any business data?” the answer is **no**. The deployment still needs plan selection, settings control, transfer review, and a strict internal policy. Compound Law advises companies in Germany and the DACH region on AI procurement, DPA review, transfer assessments, and engineering-tool governance. If you want us to review your Cursor setup, [contact us](https://compound.law/en-DE/#booking). ## FAQ ### Where can I find the Cursor DPA? Cursor publishes the DPA publicly at `cursor.com/terms/dpa`. Your team should download the current version and document which customer agreement and plan govern your actual deployment. ### Which Cursor plan is best for GDPR-compliant team use? For most German companies, **Teams** is the practical minimum and **Enterprise** is the stronger option. Free and Pro accounts can use Privacy Mode, but they are weaker from a governance and procurement perspective because they lack the same team-wide controls. ### Does Cursor use our code to train AI models? Cursor’s current Terms say Anysphere will not use content to train models unless the customer explicitly agrees. Cursor’s public Privacy Mode pages add that model providers also will not store or train on customer data in that mode, subject to abuse-detection and policy-enforcement handling. ### Does the Cursor DPA allow special-category personal data? The public DPA says customers should not provide sensitive or special-category personal data under the agreement. German teams should read that as a strong warning against routine use for HR, health, or similarly sensitive datasets. ### What is the GDPR transfer basis for Cursor? Cursor’s public DPA includes the EU Standard Contractual Clauses and the UK Addendum. That is the baseline transfer mechanism, but German companies still need to document the countries involved, review the subprocessor list, and assess whether the intended workflow fits that transfer setup. ### Is Privacy Mode enough for German compliance? No. Privacy Mode is important, but you still need the right plan, a documented transfer review, the current subprocessor list, and internal rules on code, prompts, and data handling. ### Does the DPA by itself protect code confidentiality? No. The DPA solves part of the GDPR contract layer, but code confidentiality still depends on internal usage rules, repository scoping, prompt discipline, admin controls, and the confidentiality commitments in your customer and vendor contracts. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) - [Claude Team Plan DPA & GDPR Compliance Guide tools](https://compound.law/en-DE/tools/claude-team-gdpr/) ## Frequently asked questions Cursor publishes its Data Processing Addendum publicly at cursor.com/terms/dpa. That page is the right starting point for procurement, but your team still needs to confirm which customer agreement and plan actually govern your deployment. For a company rollout in Germany, Teams or Enterprise is usually the safer baseline. Privacy Mode also exists on free and Pro, but those individual plans do not give the same centralized admin, team-wide enforcement, SSO, or audit-oriented controls. According to Cursor's current Terms, Security page, and Data Use page, enabling Privacy Mode means Cursor will not train on your data and its model providers will not store or train on that data. Abuse-detection review and limited policy-enforcement handling can still apply. No, not comfortably. The public DPA says customers should not provide sensitive or special-category personal data under the agreement. That is a strong signal against using Cursor as a routine channel for HR, health, or similarly sensitive material. Cursor's public DPA includes EU Standard Contractual Clauses and the UK Addendum. For German companies, that is the starting transfer mechanism, but the company still needs to document the countries involved, review the current subprocessor chain, and assess whether the planned workflow is appropriate for that transfer setup. Sometimes, but only with strict boundaries. Low-risk internal coding support is easier to justify than client repositories, support logs, regulated secrets, or live production data. Those cases need a deeper legal and security review. No. The DPA helps with Article 28 GDPR, but source-code confidentiality still depends on internal usage rules, restricted repositories, prompt discipline, plan-level admin controls, and whether your contracts with customers allow this vendor chain at all. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Cursor DPA: Where to Find It and Which Plan German Teams Need", "description": "Cursor publishes its DPA at cursor.com/terms/dpa — but the GDPR-safe baseline for German teams is Teams or Enterprise, Privacy Mode, plus SCC transfer review.", "image": "https://compound.law/assets/images/tools/tools_2.webp", "datePublished": "2026-06-29T00:00:00.000Z", "dateModified": "2026-06-29T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/cursor/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Cursor DPA: Where to Find It and Which Plan German Teams Need", "item": "https://compound.law/en-DE/tools/cursor/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Where can I find the Cursor DPA?", "acceptedAnswer": { "@type": "Answer", "text": "Cursor publishes its Data Processing Addendum publicly at cursor.com/terms/dpa. That page is the right starting point for procurement, but your team still needs to confirm which customer agreement and plan actually govern your deployment." } }, { "@type": "Question", "name": "Which Cursor plan is best for GDPR team use?", "acceptedAnswer": { "@type": "Answer", "text": "For a company rollout in Germany, Teams or Enterprise is usually the safer baseline. Privacy Mode also exists on free and Pro, but those individual plans do not give the same centralized admin, team-wide enforcement, SSO, or audit-oriented controls." } }, { "@type": "Question", "name": "Does Privacy Mode stop model training?", "acceptedAnswer": { "@type": "Answer", "text": "According to Cursor's current Terms, Security page, and Data Use page, enabling Privacy Mode means Cursor will not train on your data and its model providers will not store or train on that data. Abuse-detection review and limited policy-enforcement handling can still apply." } }, { "@type": "Question", "name": "Does the Cursor DPA cover special-category data?", "acceptedAnswer": { "@type": "Answer", "text": "No, not comfortably. The public DPA says customers should not provide sensitive or special-category personal data under the agreement. That is a strong signal against using Cursor as a routine channel for HR, health, or similarly sensitive material." } }, { "@type": "Question", "name": "What is the GDPR transfer basis for Cursor?", "acceptedAnswer": { "@type": "Answer", "text": "Cursor's public DPA includes EU Standard Contractual Clauses and the UK Addendum. For German companies, that is the starting transfer mechanism, but the company still needs to document the countries involved, review the current subprocessor chain, and assess whether the planned workflow is appropriate for that transfer setup." } }, { "@type": "Question", "name": "Can German teams use Cursor with client code?", "acceptedAnswer": { "@type": "Answer", "text": "Sometimes, but only with strict boundaries. Low-risk internal coding support is easier to justify than client repositories, support logs, regulated secrets, or live production data. Those cases need a deeper legal and security review." } }, { "@type": "Question", "name": "Does the DPA by itself protect code confidentiality?", "acceptedAnswer": { "@type": "Answer", "text": "No. The DPA helps with Article 28 GDPR, but source-code confidentiality still depends on internal usage rules, restricted repositories, prompt discipline, plan-level admin controls, and whether your contracts with customers allow this vendor chain at all." } } ] } ] ```