--- title: "Datadog GDPR Compliance & DPA Guide for German Companies" description: "Datadog is GDPR compliant — it signs a DPA under GDPR Art. 28, supports EU data residency in Frankfurt, and includes SCCs. Full guide for German teams." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/datadog-ai/" language: "en" --- ![Datadog GDPR compliance DPA data processing agreement Germany](https://compound.law/assets/images/tools/tools_4.webp) tools # Datadog GDPR Compliance & DPA Guide for German Companies 16 April 2026 Yes, Datadog is GDPR compliant. **Datadog signs a Data Processing Agreement (DPA) under GDPR Article 28, offers EU-region data storage with Frankfurt as the primary location (AWS eu-central-1), and has Standard Contractual Clauses (SCCs) in place for international transfers.** Datadog holds ISO 27001, SOC 2 Type II, and CSA STAR certifications. For German companies, the critical compliance tasks are: using the EU platform (app.datadoghq.eu), signing the DPA, and auditing what personal data your applications send to Datadog before enabling AI features such as Bits AI and Watchdog. ## Is Datadog GDPR Compliant? Yes. Datadog provides the following GDPR compliance infrastructure for customers: - **Data Processing Agreement (DPA):** Available in Datadog’s account settings under **Organization Settings → Legal Documents**, covering all GDPR Article 28 processor obligations. - **EU data residency:** Customers on app.datadoghq.eu have data processed and stored within the European Union. - **Standard Contractual Clauses (SCCs):** In place for transfers involving processing outside the EU/EEA. - **Sub-processor list:** Published and updated in the Datadog Trust Center; change notifications included. - **Certifications:** ISO 27001, SOC 2 Type II, CSA STAR Level 1. The compliance question is not whether Datadog is GDPR compliant — it is. The operative question is whether **your Datadog configuration** meets GDPR requirements: specifically, what personal data your applications transmit to Datadog, and whether that processing is documented in your Records of Processing Activities (RoPA). ## What Data Does Datadog Process? Datadog is an observability platform. The data it processes depends on how you instrument your systems. Understanding the data categories is essential before deploying in a GDPR context. ### Agent Data, Logs, Metrics, and APM Traces - **Application logs:** Frequently contain IP addresses, user IDs, email addresses, session identifiers, and query parameters — all of which qualify as personal data under GDPR. - **APM traces:** Distributed tracing captures URL paths, HTTP headers, and query strings that may include personal identifiers. - **Metrics:** Typically aggregated and less likely to contain personal data, but custom metrics can be tagged with user attributes. - **Real User Monitoring (RUM):** Collects browser session data, which typically includes IP addresses and behavioral data. ### Infrastructure Data - **Hostnames and IP addresses:** Server and container metadata transmitted by the Datadog Agent. - **Custom tags:** Organizations often tag infrastructure with environment, team, or project metadata. Avoid tagging with personal identifiers. - **Container and orchestration metadata:** Kubernetes pod names, Docker labels — generally not personal data but reviewed in regulated contexts. Before enabling AI features that query across this data, audit your log pipeline and apply masking or scrubbing rules. Datadog’s **Sensitive Data Scanner** identifies and masks patterns — email addresses, credit card numbers, custom regex — before data is indexed. ## Datadog’s Data Processing Agreement (DPA) ### Where to Sign Datadog’s DPA Datadog’s DPA is available directly in your account: 1. Log in to your Datadog account. 2. Navigate to **Organization Settings → Legal Documents**. 3. Accept the Data Processing Addendum — no custom negotiation required for standard deployments. For enterprise accounts, the DPA may be embedded in the Master Service Agreement. Review whether your contract already incorporates it, and retain a signed copy as part of your vendor compliance documentation. ### GDPR Article 28 Checklist for Datadog | Requirement | Datadog Coverage | | ---------------------------------------------- | -------------------------------------------- | | Processing only on documented instructions | Covered in standard DPA | | Confidentiality for authorized persons | Included | | Technical and organizational security measures | ISO 27001, SOC 2 Type II | | Sub-processor management with prior notice | Published list; change notification included | | Support for data subject rights | Deletion and export supported | | Post-processing deletion or return of data | Covered | | Audit cooperation | Available for enterprise accounts | ### Standard Contractual Clauses (SCCs) If your organization uses the US platform (app.datadoghq.com) or if Datadog’s sub-processors transfer data outside the EU/EEA, Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 must be in place. Datadog’s standard DPA incorporates SCCs. Confirm with your account team which AWS regions and sub-processors are active for your account, and document the transfer mechanism in your RoPA. ## Datadog Data Residency: EU and Germany ### Datadog EU Region — Frankfurt / AWS eu-central-1 Datadog operates a dedicated European platform at **app.datadoghq.eu**. Data is processed and stored within the European Union. The primary EU infrastructure runs on AWS eu-central-1 (Frankfurt). Key points for German companies: - **EU platform is required for EU residency.** If your organization uses app.datadoghq.com (the US platform), data is processed in the United States — SCCs must be confirmed and documented. - **Frankfurt as primary region.** For companies with strict data localisation requirements — financial services, healthcare, regulated industries — confirm with your Datadog account team that your data is confined to eu-central-1. - **Sub-processors in the EU.** Datadog’s EU-region sub-processors are published in the Trust Center. Review these during vendor onboarding. ### Data Residency Add-On For organizations with heightened data sovereignty requirements, Datadog offers a **Data Residency add-on** that contractually limits processing to a specified region. This is relevant for companies subject to sector-specific obligations beyond standard GDPR, such as financial services regulations or KRITIS requirements under German law. Request this option through your account team before signing the final contract. ## GDPR Roles: Controller vs. Processor Understanding the role allocation is required for your RoPA entry and DPA. **Your company is the data controller.** You determine the purposes and means of processing — what data is sent to Datadog, for what operational purpose, and under which legal basis. **Datadog is the data processor.** Datadog processes personal data on your instructions, as defined in the DPA. Datadog’s sub-processors (cloud infrastructure providers) are further processors acting under Datadog’s instructions. This means the legal basis for processing monitoring data — typically **legitimate interests** under GDPR Article 6(1)(f) for operational stability, or a **contractual necessity** basis where monitoring supports service delivery — is your responsibility to establish and document, not Datadog’s. ## Key Certifications: SOC 2, ISO 27001, CSA STAR Datadog’s security certifications support Article 28 compliance by evidencing technical and organizational measures (TOMs): - **ISO/IEC 27001:** International standard for information security management systems. Relevant for vendor risk assessments. - **SOC 2 Type II:** Independent audit of security, availability, and confidentiality controls over a period of time (stronger than Type I). Request the report under NDA for your vendor assessment documentation. - **CSA STAR Level 1:** Cloud Security Alliance self-assessment against the Cloud Controls Matrix (CCM). Available publicly in the CSA STAR registry. These certifications satisfy the Article 28(3)(c) requirement for TOMs without requiring you to conduct your own audit for standard deployments. ## Legal Basis for Processing Monitoring Data Most infrastructure monitoring under Datadog falls under **legitimate interests** (GDPR Article 6(1)(f)): - **Purpose:** Operational stability, security monitoring, performance optimisation. - **Necessity:** Monitoring is necessary to detect incidents, ensure uptime, and protect systems. - **Balancing test:** The processing is proportionate; impact on individuals is minimal when personal data is incidental to operational metrics. When monitoring extends to **employee activity** — access logs, developer activity, or performance metrics linked to individuals — the legal basis shifts. In Germany, **§ 26 BDSG** governs employee data processing. A works council co-determination requirement under **§ 87(1)(6) BetrVG** applies when Datadog is used to monitor employee behaviour. Obtain works council approval or conclude a works agreement (Betriebsvereinbarung) before deploying monitoring that captures employee-linked activity. For high-risk processing, consider whether a **Data Protection Impact Assessment (DPIA)** under GDPR Article 35 is required. Standard DevOps monitoring typically does not require a DPIA; systematic employee behaviour monitoring typically does. ## Checklist: Using Datadog Compliantly in Germany 1. **Use the EU platform** — confirm your organization is on app.datadoghq.eu. 2. **Sign the DPA** — via Organization Settings → Legal Documents; retain a copy. 3. **Audit personal data in your pipeline** — logs, APM traces, RUM sessions. 4. **Configure data masking** — Sensitive Data Scanner and APM obfuscation rules. 5. **Update your RoPA** — add Datadog as processor with purpose, data categories, and retention. 6. **Works council check** — assess § 87(1)(6) BetrVG applicability if employee activity is visible. 7. **Confirm EU region** — verify AWS eu-central-1 is active if Frankfurt-only is required. ## How Compound Law Helps German companies deploying Datadog frequently need legal support with: - **DPA review** — checking Datadog’s standard DPA against your processing context and data flows - **RoPA entry** — documenting Datadog as a processor in your Article 30 records - **DPIA** — when Datadog processes significant personal data or employee-linked activity at scale - **Works council coordination** — § 87(1)(6) BetrVG analysis and Betriebsvereinbarung drafting - **Vendor risk assessment** — review of certifications and sub-processor list For related compliance guides, see our [AWS Bedrock GDPR guide](https://compound.law/en-DE/tools/aws-bedrock/), [Azure OpenAI GDPR & DPA guide](https://compound.law/en-DE/tools/azure-openai/), [Claude Enterprise DPA guide](https://compound.law/en-DE/tools/claude-enterprise/), and [GDPR compliance hub](https://compound.law/en-DE/compliance/). ## Frequently Asked Questions ### Does Datadog have a GDPR DPA? Yes. Datadog provides a standard Data Processing Addendum (DPA) under GDPR Article 28. It is available in your Datadog account under **Organization Settings → Legal Documents** and can be accepted without custom negotiation. Enterprise customers may have the DPA incorporated in their Master Service Agreement. ### Where does Datadog store data by default? By default, Datadog stores data on its US platform (app.datadoghq.com) using AWS infrastructure in the United States. To store data in the EU, your organization must use the EU platform at **app.datadoghq.eu**, which uses AWS eu-central-1 (Frankfurt) as the primary region. These are separate platforms — migrating between them requires creating a new Datadog organization. ### Can I restrict data to EU data centres? Yes. Using app.datadoghq.eu restricts processing to EU infrastructure. Datadog’s Data Residency add-on provides contractual guarantees for region-specific storage. Confirm the exact AWS regions active for your account with your Datadog account team, particularly if your compliance obligations require Frankfurt-only data storage. ### What personal data does Datadog collect? Datadog does not independently collect personal data — it processes whatever your applications transmit to it. Common personal data categories found in Datadog instances include: IP addresses (GDPR Recital 30), user IDs and email addresses in application logs, session identifiers in access logs, and URL paths or query parameters captured by APM. Apply Datadog’s Sensitive Data Scanner and APM obfuscation rules to reduce personal data exposure in your instance. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Yes. Datadog provides a standard Data Processing Addendum (DPA) under GDPR Article 28. It is available in your Datadog account under \*\*Organization Settings → Legal Documents\*\* and can be accepted without custom negotiation. Enterprise customers may have the DPA incorporated in their Master Service Agreement. By default, Datadog stores data on its US platform (app.datadoghq.com) using AWS infrastructure in the United States. To store data in the EU, your organization must use the EU platform at \*\*app.datadoghq.eu\*\*, which uses AWS eu-central-1 (Frankfurt) as the primary region. These are separate platforms — migrating between them requires creating a new Datadog organization. Yes. Using app.datadoghq.eu restricts processing to EU infrastructure. Datadog's Data Residency add-on provides contractual guarantees for region-specific storage. Confirm the exact AWS regions active for your account with your Datadog account team, particularly if your compliance obligations require Frankfurt-only data storage. Datadog does not independently collect personal data — it processes whatever your applications transmit to it. Common personal data categories found in Datadog instances include: IP addresses (GDPR Recital 30), user IDs and email addresses in application logs, session identifiers in access logs, and URL paths or query parameters captured by APM. Apply Datadog's Sensitive Data Scanner and APM obfuscation rules to reduce personal data exposure in your instance. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Datadog GDPR Compliance & DPA Guide for German Companies", "description": "Datadog is GDPR compliant — it signs a DPA under GDPR Art. 28, supports EU data residency in Frankfurt, and includes SCCs. Full guide for German teams.", "image": "https://compound.law/assets/images/tools/tools_4.webp", "datePublished": "2026-04-16T00:00:00.000Z", "dateModified": "2026-04-16T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/datadog-ai/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Datadog GDPR Compliance & DPA Guide for German Companies", "item": "https://compound.law/en-DE/tools/datadog-ai/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does Datadog have a GDPR DPA?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Datadog provides a standard Data Processing Addendum (DPA) under GDPR Article 28. It is available in your Datadog account under **Organization Settings → Legal Documents** and can be accepted without custom negotiation. Enterprise customers may have the DPA incorporated in their Master Service Agreement." } }, { "@type": "Question", "name": "Where does Datadog store data by default?", "acceptedAnswer": { "@type": "Answer", "text": "By default, Datadog stores data on its US platform (app.datadoghq.com) using AWS infrastructure in the United States. To store data in the EU, your organization must use the EU platform at **app.datadoghq.eu**, which uses AWS eu-central-1 (Frankfurt) as the primary region. These are separate platforms — migrating between them requires creating a new Datadog organization." } }, { "@type": "Question", "name": "Can I restrict data to EU data centres?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Using app.datadoghq.eu restricts processing to EU infrastructure. Datadog's Data Residency add-on provides contractual guarantees for region-specific storage. Confirm the exact AWS regions active for your account with your Datadog account team, particularly if your compliance obligations require Frankfurt-only data storage." } }, { "@type": "Question", "name": "What personal data does Datadog collect?", "acceptedAnswer": { "@type": "Answer", "text": "Datadog does not independently collect personal data — it processes whatever your applications transmit to it. Common personal data categories found in Datadog instances include: IP addresses (GDPR Recital 30), user IDs and email addresses in application logs, session identifiers in access logs, and URL paths or query parameters captured by APM. Apply Datadog's Sensitive Data Scanner and APM obfuscation rules to reduce personal data exposure in your instance." } } ] } ] ```