--- title: "Is DeepSeek GDPR Compliant? What German Companies Need to Know" description: "Hosted DeepSeek still creates GDPR and procurement risk for German companies. Self-hosted deployments can work with EU infrastructure and proper controls." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/deepseek/" language: "en" --- ![DeepSeek GDPR compliance analysis for German companies](https://compound.law/assets/images/tools/tools_3.webp) tools # Is DeepSeek GDPR Compliant? What German Companies Need to Know 29 June 2026 Is DeepSeek compliant for German business use? Usually no for the hosted service, but self-hosted deployments can work. As of 29 June 2026, DeepSeek's published policy still points to personal-data processing and storage in China, and German regulators still treat the service as high-risk. EU-hosted open-weight deployments are a separate compliance scenario. - Hosted DeepSeek is not a safe default for personal-data use by German companies. - DeepSeek's public policy still points to PRC storage and model-improvement processing. - Berlin's DPA said on June 23, 2026 that Apple and Google rejected its takedown request and that further DSA steps may follow. - Self-hosted DeepSeek on EU infrastructure can be documented as a separate, lower-risk setup. **Hosted DeepSeek is not the safe default for German companies processing personal data, but self-hosted DeepSeek can be a different legal answer.** As of **June 29, 2026**, DeepSeek’s published privacy policy still says it directly collects, processes, and stores personal data in the **People’s Republic of China**, while German regulators continue to challenge those transfers. If you need DeepSeek-class performance, the practical split is: avoid the hosted service for personal-data workflows, or use the open-weight models on controlled EU infrastructure with proper contracts and documentation. ## Hosted DeepSeek vs Self-Hosted DeepSeek: The Short Answer For most German businesses, the right first answer is simple: - **Hosted DeepSeek cloud:** not a safe default for workflows involving personal data - **Sandboxed no-personal-data experimentation:** possible only with strict internal controls - **Self-hosted DeepSeek models in the EU:** potentially workable with proper procurement and governance That split matters because **the legal risk attaches to the service model, not just the model name**. A Chinese-operated hosted chatbot and an open-weight model deployed inside your own EU environment are not the same compliance scenario. ## Why Hosted DeepSeek Still Creates GDPR Risk in June 2026 ### DeepSeek’s own policy still points to PRC storage DeepSeek’s current published privacy policy says that personal data may be stored outside the user’s country and that, to provide the service, DeepSeek directly collects, processes, and stores personal data in the **People’s Republic of China**. The same policy also says DeepSeek uses personal data to **train and improve its technology**. For German organisations, that creates an immediate vendor-risk problem: - prompts and uploads can contain personal data or confidential business information - service logs and device data are also in scope - third-country transfer analysis is unavoidable from the start This is why DeepSeek cloud cannot be treated like a low-friction productivity tool for HR, legal, support, or sales workflows. ### Public procurement documentation remains weak for German buyers German companies normally need a clean procurement file before approving any AI vendor for personal-data use. In practice that means checking: 1. a usable **DPA/AVV** under Article 28 GDPR 2. the transfer mechanism and supporting documentation 3. security and retention commitments 4. the provider’s role in model training and telemetry As of **June 29, 2026**, we did **not** find a public enterprise DPA/AVV package or a public SCC package suitable for routine German procurement of DeepSeek’s hosted service. That does not prove no such paper exists in every private deal, but it does mean the hosted product is not procurement-ready in the way German legal and privacy teams usually require. If you need a benchmark for what a compliant vendor file should look like, compare it with our guides on [GDPR AI procurement](https://compound.law/en-DE/compliance/gdpr-ai-procurement/), the [AI vendor assessment checklist](https://compound.law/en-DE/compliance/gdpr-ai-vendor-assessment-checklist/), and a proper [data processing agreement](https://compound.law/en-DE/compliance/data-processing-agreement/). ### German regulators are still escalating, not cooling off The German regulatory signal is still negative: - On **June 27, 2025**, the **Berlin Commissioner for Data Protection and Freedom of Information** notified Apple and Google that the DeepSeek app should be treated as illegal content in Germany because of unlawful data transfers to China. - The **LfD Niedersachsen** warned that, based on current knowledge, DeepSeek does not satisfy key requirements of the GDPR and the EU AI Act. - In its **2025 annual report published on June 23, 2026**, the Berlin DPA said Apple and Google had rejected its request to block the app and that it intends to pursue further steps under **Articles 20 and 21 DSA**. That is the freshest official 2026 signal on the German enforcement path: the matter is still live. ## What Changed Since Earlier DeepSeek Analyses An older version of this page treated the lack of an EU representative as one of the headline defects. That point now needs a narrower statement. DeepSeek’s current privacy policy names **Prighter Group** as privacy representative and point of contact for the **EU** and **UK**. That helps with contactability, but it does **not** solve the two issues that matter most for German companies: - the hosted service still routes personal data into a high-risk transfer scenario - the hosted product still lacks the procurement clarity that German privacy and legal teams usually need In other words: the representative point improved, but the hosted-service risk case did not disappear. ## Decision Framework for German Companies Use this practical split when deciding whether DeepSeek belongs anywhere in your organisation: | Scenario | Recommended posture | Why | | ------------------------------------------------------------------------------------------------- | ------------------------------------------- | --------------------------------------------------------------------------- | | Employees using hosted DeepSeek for HR, customer, legal, or internal documents with personal data | **Prohibit** | Highest GDPR and confidentiality risk | | Limited experimentation with synthetic or fully anonymised data | **Sandbox only** | Still needs policy controls, access limits, and logging | | Self-hosted DeepSeek on your own EU infrastructure | **Assess and document** | Different legal posture because the hosted DeepSeek service is not involved | | DeepSeek weights served by an EU provider | **Run full vendor review on that provider** | The provider, not DeepSeek cloud, becomes the primary procurement target | For many German companies, the best policy is: 1. **ban hosted DeepSeek for personal-data workflows** 2. **allow only controlled testing with non-personal data** 3. **approve self-hosted or EU-hosted alternatives only after vendor review** If you are formalising that process, our guide to [AI vendor due diligence in Germany](https://compound.law/en-DE/compliance/ai-vendor-due-diligence-germany/) and [EU AI Act procurement requirements](https://compound.law/en-DE/compliance/eu-ai-act-procurement-requirements-german-enterprises/) is the next step. ## When Self-Hosted DeepSeek Can Be the Better Answer DeepSeek’s open-weight models can be legally easier to use than DeepSeek cloud because you can separate the **model weights** from the **hosted service**. That setup is more defensible when: - prompts stay inside your own EU environment - your infrastructure provider signs the necessary DPA/AVV - you document the processing in your **ROPA** - you run a **DPIA** where the use case requires it - access, logging, and retention are aligned with internal policy This is broadly the same pathway discussed for [self-hosted Llama](https://compound.law/en-DE/tools/llama/). If you want a more procurement-ready commercial option instead, compare [Claude Enterprise GDPR positioning](https://compound.law/en-DE/tools/claude-enterprise-gdpr/) and related DPA material before making a buying decision. ## Practical Checklist - [ ] Block hosted DeepSeek for workflows involving personal data - [ ] Review whether any teams already used DeepSeek with customer, employee, or contract data - [ ] Decide whether limited sandbox use without personal data is acceptable - [ ] If DeepSeek capability is needed, assess self-hosted or EU-hosted deployment instead - [ ] Record the decision in your AI governance and vendor review process - [ ] Update internal training so employees understand that “open-weight” and “hosted cloud” are different risk categories *** *This page provides general legal information, not legal advice. Specific procurement, transfer, and AI-governance decisions should be reviewed against your actual data flows and deployment model. For situation-specific support, contact [Compound Law](https://compound.law/en-DE/contact/).* ## Frequently Asked Questions ### Is DeepSeek GDPR compliant? For the hosted DeepSeek service, usually no for German companies processing personal data. For self-hosted deployments on controlled EU infrastructure, compliance can be possible with the right contracts, governance, and documentation. ### Is DeepSeek banned in Germany? No formal statutory ban exists. But on June 27, 2025, the Berlin DPA asked Apple and Google to block the app in Germany, and in its June 23, 2026 annual report it said both platforms rejected that request and further DSA steps may follow. ### Can I self-host DeepSeek in the EU? Yes. If you run DeepSeek’s open-weight models on your own EU infrastructure or through a properly contracted EU provider, the legal analysis is different from using DeepSeek’s hosted cloud service. ### Does DeepSeek offer a DPA or AVV? We did not find a public enterprise DPA or AVV package for German procurement as of June 29, 2026. That makes vendor due diligence and lawful personal-data use materially harder for the hosted service. ### Does DeepSeek send prompts or telemetry to China? DeepSeek’s published privacy policy says it directly collects, processes, and stores personal data in the People’s Republic of China, including user inputs and service data. That is a core transfer-risk issue for German companies. ### What if I use DeepSeek through an EU host? Then assess the EU host as the relevant vendor. If prompts stay within the EU-hosted environment and do not go back to DeepSeek-operated services, the compliance analysis is closer to other self-hosted open-weight models. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) - [Claude Team Plan DPA & GDPR Compliance Guide tools](https://compound.law/en-DE/tools/claude-team-gdpr/) ## Frequently asked questions For the hosted DeepSeek service, usually no for German companies processing personal data. For self-hosted deployments on controlled EU infrastructure, compliance can be possible with the right contracts, governance, and documentation. No formal statutory ban exists. But on June 27, 2025, the Berlin DPA asked Apple and Google to block the app in Germany, and in its June 23, 2026 annual report it said both platforms rejected that request and further DSA steps may follow. Yes. If you run DeepSeek's open-weight models on your own EU infrastructure or through a properly contracted EU provider, the legal analysis is different from using DeepSeek's hosted cloud service. We did not find a public enterprise DPA or AVV package for German procurement as of June 29, 2026. That makes vendor due diligence and lawful personal-data use materially harder for the hosted service. DeepSeek's published privacy policy says it directly collects, processes, and stores personal data in the People's Republic of China, including user inputs and service data. That is a core transfer-risk issue for German companies. Then assess the EU host as the relevant vendor. If prompts stay within the EU-hosted environment and do not go back to DeepSeek-operated services, the compliance analysis is closer to other self-hosted open-weight models. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Is DeepSeek GDPR Compliant? What German Companies Need to Know", "description": "Hosted DeepSeek still creates GDPR and procurement risk for German companies. Self-hosted deployments can work with EU infrastructure and proper controls.", "image": "https://compound.law/assets/images/tools/tools_3.webp", "datePublished": "2026-06-29T00:00:00.000Z", "dateModified": "2026-06-29T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/deepseek/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Is DeepSeek GDPR Compliant? What German Companies Need to Know", "item": "https://compound.law/en-DE/tools/deepseek/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is DeepSeek GDPR compliant?", "acceptedAnswer": { "@type": "Answer", "text": "For the hosted DeepSeek service, usually no for German companies processing personal data. For self-hosted deployments on controlled EU infrastructure, compliance can be possible with the right contracts, governance, and documentation." } }, { "@type": "Question", "name": "Is DeepSeek banned in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "No formal statutory ban exists. But on June 27, 2025, the Berlin DPA asked Apple and Google to block the app in Germany, and in its June 23, 2026 annual report it said both platforms rejected that request and further DSA steps may follow." } }, { "@type": "Question", "name": "Can I self-host DeepSeek in the EU?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. If you run DeepSeek's open-weight models on your own EU infrastructure or through a properly contracted EU provider, the legal analysis is different from using DeepSeek's hosted cloud service." } }, { "@type": "Question", "name": "Does DeepSeek offer a DPA or AVV?", "acceptedAnswer": { "@type": "Answer", "text": "We did not find a public enterprise DPA or AVV package for German procurement as of June 29, 2026. That makes vendor due diligence and lawful personal-data use materially harder for the hosted service." } }, { "@type": "Question", "name": "Does DeepSeek send prompts or telemetry to China?", "acceptedAnswer": { "@type": "Answer", "text": "DeepSeek's published privacy policy says it directly collects, processes, and stores personal data in the People's Republic of China, including user inputs and service data. That is a core transfer-risk issue for German companies." } }, { "@type": "Question", "name": "What if I use DeepSeek through an EU host?", "acceptedAnswer": { "@type": "Answer", "text": "Then assess the EU host as the relevant vendor. If prompts stay within the EU-hosted environment and do not go back to DeepSeek-operated services, the compliance analysis is closer to other self-hosted open-weight models." } } ] } ] ```