What is the DeepL DPA and where do I get it?

The DeepL DPA is DeepL SE's Article 28 GDPR data processing agreement for paid Pro services. It is an integral part of the DeepL Pro terms, becomes binding on conclusion, and is published in the DeepL Trust Center together with the subprocessor list, security measures, and SCCs.

• DeepL SE (Cologne) is the processor; the customer is the controller; AWS acts as a subprocessor under the 2026 hybrid infrastructure model.
• The DPA binds automatically when a Pro contract is concluded — DeepL Pro Terms section 8.1.5 requires no separate signature.
• Transfers rest on the EU–U.S. Data Privacy Framework and SCCs; the Data Residency add-on covers Team, Business, and API for Business plans.

Yes — DeepL SE provides a data processing agreement (DPA) under Article 28 GDPR for all paid Pro services, and under the current DeepL Pro terms that DPA is an integral part of the contract, binding automatically upon conclusion. You do not need to negotiate it. The document is published in the DeepL Trust Center, alongside the subprocessor list — which since 2026 includes AWS — the security measures, and the Standard Contractual Clauses (SCCs) used for transfers outside the EEA.

This page is an independent, law-firm annotation of what the DeepL DPA and its surrounding contract documents say, clause by clause, with the official access path signposted. It is not a DeepL document. Every statement is sourced from DeepL’s own materials — the Pro Terms, the Trust Center, and DeepL’s infrastructure and data protection notice — current as of October 2026.

Reviewed: October 2026

DeepL DPA quick facts

Item	What DeepL documents (as of October 2026)
Contracting entity	DeepL SE, Maarweg 165, 50825 Cologne, Germany
Legal basis	Integral part of the DeepL Pro Terms; binding upon contract conclusion (Pro Terms §8.1.5)
Roles	Customer = controller; DeepL SE = processor; AWS = subprocessor
Transfer mechanism	EU–U.S. Data Privacy Framework + Standard Contractual Clauses (SCCs); Transfer Impact Assessment in the Trust Center
Subprocessors	AWS for business and enterprise content processing since January 1, 2026; current list in the Trust Center
Default processing location	Global AWS regions (EU, US, JP) plus DeepL servers in Europe; transient by default
Retention	No long-term storage by default; encrypted debugging exception up to 72 hours; customer-requested storage (e.g., saved translations) deleted up to 90 days after the agreement ends
Free products	Free API may store content indefinitely; personal data is prohibited on the free API (Pro Terms §3.3.2, §8.3.11)
Where to obtain	DeepL Trust Center → Legal → Data Processing Agreement

How to get the official DeepL DPA

The DPA is no longer a document you must request from sales. Here is the honest, current access path:

1. Open the DeepL Trust Center at deepl.safebase.us. The Legal section lists the Data Processing Agreement together with “DPA Sub-Processors,” “DPA Technical and Organisational Measures,” and “International Transfer Clauses.”
2. Open the Data Processing Agreement item. The Trust Center runs on SafeBase. The document list and DeepL’s infrastructure disclosures are publicly viewable; downloading the underlying files runs through a “Get access” request flow (name, company email, purpose). When we last checked, the full DPA file could not be retrieved anonymously — plan a few minutes for the access request.
3. If you are a paying Pro customer, nothing needs to be signed. Section 8.1.5 of the DeepL Pro Terms states that the DPA “forms an integral part of this Agreement and becomes binding upon its conclusion.” Your conclusion of the Pro subscription already incorporates it.
4. Archive the complete contract set. Store the DPA together with the Pro Terms, the Service Specification agreed at order, the subprocessor list, the TOMs, and the transfer clauses. If you buy the Data Residency add-on, its contractual terms come through your sales or account contact.

For enterprise and sales-assisted deals, your account team provides the DPA bundle directly; if your checklist demands a countersigned instrument, raise it there.

What the DeepL DPA covers, clause by clause

DeepL publishes the DPA itself through the Trust Center, and the surrounding obligations in its Pro Terms and infrastructure notice. The walk-through below documents each Art. 28 GDPR topic from those public sources. Where a point sits inside the gated DPA file, we say so rather than inventing clause numbers.

Processing instructions and scope

What the documents say: Section 8.1.5 of the Pro Terms governs personal-data transmissions: the customer must observe all legal requirements for collecting, processing, and using data sent to DeepL, and may not transmit personal data without the data subject’s consent or another sufficient legal authorization. The DPA listed in the Trust Center is the Art. 28 instrument, and DeepL commits to “reasonably cooperate” in implementing required legal authorizations.

What it means for a German buyer: Your company remains the controller. Before rollout, confirm the lawful basis for the personal data your teams will translate — customer emails, HR documents, or support tickets each need their own justification. The DPA covers the processor relationship; it does not create a legal basis for you.

Security measures (TOMs)

What the documents say: DeepL’s infrastructure notice states that all data is encrypted in transit and at rest, that encryption keys are controlled by DeepL and not by AWS, and that DeepL applies a zero-trust security model. The Trust Center lists ISO/IEC 27001:2022 certification, SOC 2 Type 2, the German BSI’s C5 attestation (Type 2), and HIPAA compliance, and publishes a “DPA Technical and Organisational Measures” document in its Legal section.

What it means for a German buyer: C5 is the criterion catalogue German public-sector and many enterprise buyers screen for, and its presence removes a common procurement blocker. For the vendor file, download the TOMs document via the same Trust Center access flow as the DPA rather than relying on marketing pages.

Subprocessors — including AWS

What the documents say: AWS is documented as a subprocessor under the 2026 hybrid infrastructure model: DeepL processes business and enterprise customer content on AWS in addition to its own European data centers, while DeepL’s proprietary translation models run in a DeepL-controlled environment on that infrastructure. The current subprocessor list is published in the Trust Center (“DPA Sub-Processors”), and DeepL states that its relationship with AWS is governed by a data processing agreement containing the mandatory Article 28 GDPR terms.

What it means for a German buyer: Subprocessor transparency and an objection mechanism exist, but the default is broad: AWS regions worldwide can be used unless you contract for residency. Log the subprocessor list URL in your review record and re-check it at renewal — this list is exactly what Art. 28(2) GDPR requires you to track.

International transfers (SCCs and the EU–U.S. DPF)

What the documents say: DeepL’s infrastructure notice names the EU–U.S. Data Privacy Framework and Standard Contractual Clauses as the safeguards for international data transfers, and points to a Transfer Impact Assessment (TIA) in the Trust Center. The Trust Center’s infrastructure update confirms that SCCs are implemented for any processing outside the EEA.

What it means for a German buyer: A vendor-side TIA is a useful starting point, but the controller owns the transfer assessment. Review DeepL’s TIA against your own data classes, supplement it where your scenario differs, and document the conclusion — this is one of the most common gaps in German AI-tool file audits.

Retention and deletion

What the documents say: Section 3.1.2 of the Pro Terms limits storage to what is technically required; further storage happens only at the customer’s request (for example, saved translations), and such stored content is deleted 90 days after the agreement ends. Section 3.1.4 allows encrypted debugging retention of up to 72 hours in exceptional error cases, with automatic deletion afterwards, key access restricted to logged, management-approved individual cases, and no linkage to an individual customer. Access logs kept for billing and security contain no content.

What it means for a German buyer: These are concrete, quotable retention terms — better than most consumer AI tools offer. State them precisely in your processing record (Verzeichnis von Verarbeitungstätigkeiten): transient by default, 72-hour encrypted debugging exception, 90-day post-termination deletion for requested storage.

Controller assistance

What the documents say: The Pro Terms commit DeepL to reasonable cooperation in implementing legal authorizations for personal data (§8.1.5), and the Trust Center provides the artifacts a controller needs for accountability: the data flow diagram, the TIA, the TOMs, and a Security and Data Residency Whitepaper available in English, German, and Japanese. Data subject rights handling is addressed in the DPA document itself, which is distributed through the Trust Center access flow.

What it means for a German buyer: For DPIA purposes, the publicly available whitepaper plus the data flow diagram usually satisfy the processing description a German privacy team needs. If your DPIA requires named contact channels for data subject requests, confirm them with your account contact — that operational detail sits in the gated document set.

Data residency option

What the documents say: The Data Residency add-on restricts customer content data to one selected region — EU, US, or JP. It is available to sales-assisted customers on Team, Business, and API for Business plans, included as standard in DeepL for Enterprise, limited to one region per organization, and must be purchased for all subscriptions in scope. Operational logging and monitoring may run outside the selected region, but DeepL states these do not contain customer content data.

What it means for a German buyer: EU residency is contractual, not a separate product: budget for it in the sales conversation, and note that it cannot be self-served from the website. For sectors with strict EU-processing expectations, combine the residency add-on with the SCC/TIA review — residency reduces transfer exposure but does not eliminate subprocessor due diligence.

What changed with AWS in 2026

Three facts define the current setup, and all three come from DeepL’s own infrastructure update effective January 1, 2026:

• Global processing is the default. Customer content may be processed across AWS regions in the EU, US, and JP. The old “EU-only by default” assumption no longer holds on new contracts and renewals.
• DeepL’s own data centers changed roles. The proprietary data centers in Iceland and Sweden now serve research, model training, and free-tier users — business and enterprise content processing moved to the hybrid model.
• Objection and residency paths exist. Customers who object to the AWS-inclusive terms can use DeepL until the end of their current billing period, with data kept on DeepL infrastructure until the contract ends. Eligible sales-assisted customers can instead pin processing to a single region through the Data Residency add-on.

For an approval decision, the practical summary is: AWS participation is contractual and documented, the objection window is short, and EU-only processing now requires the residency add-on rather than being the baseline.

What the DeepL DPA does not cover

• Sector-specific confidentiality. Legal professional privilege, medical confidentiality, and banking secrecy are your obligations, not the processor’s — a DPA does not lift them.
• High-risk use under the EU AI Act. Pro Terms §8.1.2 states the services are not intended for high-risk use under Article 6 of the EU AI Act, and the customer is solely responsible for that assessment.
• The free tier. The free API may store content indefinitely and prohibits personal data outright (§3.3.2, §8.3.11); the DPA regime described here applies to paid services.
• Your own usage-data processing. Usage data DeepL provides about your users (§3.1.10) makes you an independent controller with your own GDPR duties.
• Vendor selection and procurement diligence. The DPA is one artifact in an Art. 28 review, not a substitute for the structured vendor workflow — see our GDPR AI procurement guide and our AI translation compliance guide for that process.

DeepL DPA vs. other AI vendor DPAs

Vendor	DPA availability	Auto-incorporated into terms?	Transfer safeguards	EU residency option
DeepL SE	Trust Center, integral part of Pro terms	Yes, upon contract conclusion (§8.1.5)	EU–U.S. DPF + SCCs, vendor TIA published	Yes — sales-assisted add-on; standard in Enterprise
Anthropic (Claude)	DPA for Enterprise and API	Part of commercial terms	SCCs	EU hosting options for eligible plans
Asana	DPA on all paid plans	Yes, referenced in terms	SCCs	Data residency controls per plan
Grammarly	DPA for Enterprise	Via enterprise agreement	SCCs	Limited, plan-dependent

DeepL’s distinguishing feature is the automatic-incorporation mechanism: unlike vendors where the DPA is a separate click-through or signature step, DeepL’s Pro terms bind it on contract conclusion and publish it for pre-contract review. That is why this page can annotate the document’s content before you ever talk to sales.

FAQ: DeepL DPA questions

Does DeepL have a DPA?

Yes. DeepL SE publishes a data processing agreement under Article 28 GDPR in its Trust Center, and under the current Pro terms (§8.1.5) it forms an integral part of the Pro agreement, binding automatically upon contract conclusion. Paid customers do not need to negotiate or countersign it, though archiving a downloaded copy is good practice.

Is DeepL GDPR-compliant?

DeepL is headquartered in Cologne and directly subject to the GDPR. It documents an Article 28 DPA, EU–U.S. DPF and SCC-based transfers, ISO/IEC 27001:2022, SOC 2 Type 2, and C5 attestations. Whether a specific rollout is compliant depends on your lawful basis, enabled features, and data classes — that assessment is yours, not the vendor’s.

Does DeepL train AI models on customer translations?

On paid subscriptions, DeepL states that data is processed only to provide the services and is not used for training models outside your account. Research and model training run on DeepL’s own Iceland/Sweden infrastructure, which also serves free-tier users. The free API reserves the right to store content indefinitely and prohibits personal data.

Where is DeepL data stored?

By default, customer content may be processed across DeepL’s global AWS regions (EU, US, JP) plus DeepL servers in Europe, and translation input is processed transiently. Storage features such as saved translations keep content until deletion, with deletion 90 days after the agreement ends. The Data Residency add-on pins processing to one selected region for eligible plans.

Does DeepL use AWS or other subprocessors?

Yes. AWS is a documented subprocessor under the 2026 hybrid infrastructure model, handling business and enterprise content processing while DeepL’s models run in a DeepL-controlled environment. The current subprocessor list is a legal document in the Trust Center, and DeepL’s infrastructure notice describes the objection path for subprocessor changes.

Does DeepL offer EU data residency?

Yes. The Data Residency add-on covers sales-assisted Team, Business, and API for Business plans and is included as standard in DeepL for Enterprise. One region per organization — EU, US, or JP — and it must apply to all subscriptions in scope. Logging and monitoring may operate outside the region but without customer content data, per DeepL’s disclosures.

How do I sign the DeepL DPA?

Usually you do not. DeepL Pro Terms §8.1.5 makes the Trust Center DPA an integral part of the agreement, binding upon conclusion. Enterprise customers receive the DPA through their account or sales contact, along with any residency terms. Download and archive the DPA, subprocessor list, TOMs, and transfer clauses before transmitting personal data.

This article provides general information, not legal advice for a specific case. Specific DeepL rollouts involving regulated, secrecy-bound, or otherwise high-risk data should be reviewed individually.

Compound Law advises founders, in-house teams, and procurement stakeholders in Germany on DPAs, AI vendor review, confidentiality-sensitive workflows, and GDPR implementation. If you need a DeepL approval memo, a DPA review, or a broader procurement framework, contact us.