Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany

Does ElevenLabs offer a DPA?

Yes. ElevenLabs publishes its Data Processing Addendum at elevenlabs.io/dpa. It forms part of the ElevenLabs terms, includes EU Standard Contractual Clauses governed by Irish law, and applies whenever ElevenLabs processes personal data contained in your content on your documented instructions.

• The DPA is a public document at elevenlabs.io/dpa — no login or signature flow, and the SCCs are incorporated automatically.
• German buyers contract with Eleven Labs Inc., New York; the SCC layer is governed by Irish law, the main terms by New York law.
• Enterprise content is deleted within 30 days of termination; self-serve deletion only applies after 180 days of inactivity.

Yes — ElevenLabs offers a Data Processing Agreement. The ElevenLabs DPA is published as a public web page at elevenlabs.io/dpa (version dated April 8, 2026), forms part of the ElevenLabs terms, and applies whenever ElevenLabs processes personal data contained in your content — audio, video, or text — on your documented instructions.

This page reviews the ElevenLabs DPA as a procurement document for German companies: what each clause covers, where it meets Article 28 GDPR, and where your organisation needs to add compliance work of its own. It provides general information, not legal advice for a specific situation. For the structured vendor-selection frame around this document, see our GDPR AI procurement guide; for the broader tool assessment, see our ElevenLabs review.

What the ElevenLabs DPA Covers: Clause-Level Index

ElevenLabs structures the DPA into thirteen numbered sections plus two annexes. The document governs ElevenLabs’ processing of “Customer Personal Data” — personal data contained in the audio, video, and text content you upload — and sets out the parties, the transfer description, and the security measures in Annexes I and II. The table below maps the clause structure so procurement and privacy teams can navigate the document quickly.

Clause	What it covers	Procurement note
§1 Definitions	”Applicable Data Protection Laws” spans the EU GDPR and e-Privacy Directive, UK and Swiss law, the CCPA, and Brazil’s LGPD; defines the EEA SCCs, UK Addendum, and Brazil SCCs	Confirms the EU GDPR is directly addressed, not just US privacy law
§2 Scope	Applies when ElevenLabs processes Customer Personal Data as processor; the customer may act as controller or as processor for a third-party controller	Covers agency use — agencies processing for their own clients must hold the necessary authorizations
§3 Instructions	Processing only on the documented instructions set out in the agreement; duty to flag conflicting legal obligations	Your contract documents and configuration are the instruction set — keep them precise
§4 Personnel	Confidentiality obligations and need-to-know access for employees, agents, and contractors	Matches Article 28(3)(b) GDPR
§5 Security	Technical and organizational measures per Annex II, published at compliance.elevenlabs.io	TOMs may be updated by publication — monitor the trust center
§6 Subprocessing	General authorization; subprocessor list at compliance.elevenlabs.io; 30 days’ notice by list update; objection within the notice period; termination right if unresolved	The objection window runs inside the 30-day notice period — assign an owner before rollout
§7 Data subject rights	Assistance with access, rectification, and erasure requests; data subject requests are forwarded to you	Matches Article 28(3)(e) GDPR
§8 Breach	Notification without undue delay after confirming a Security Incident, plus cooperation on your reporting duties	The trigger is confirmation, not mere awareness — note this in your incident runbook
§9 Deletion and return	DPA terminates with the agreement; enterprise services: deletion within 30 days of termination; self-serve services: optional deletion after 180 days of inactivity; backup carve-out	The self-serve deletion right is discretionary — document your retention position explicitly
§10 Audit	A current third-party audit certification or report — such as a SOC 2 Type II — satisfies audit rights; virtual audits by mutual agreement at customer cost absent material breach; DPIA assistance	Audit access is report-based — request the SOC 2 report before rollout
§11 Transfers	Adequacy decisions including the EU-US Data Privacy Framework; EEA SCCs (controller-to-processor or processor-to-processor module); Clause 17 Option 1: Irish law; Clause 18(b): Irish courts; UK Addendum and Swiss FADP adaptations	The SCCs are deemed executed automatically — no signature action needed from you
§12 US privacy law	CCPA no-sell and no-share commitments	Relevant for US-facing deployments
§13 Data residency	Optional residency on request, subject to ElevenLabs’ discretion; carve-outs for subprocessors, support access, and the moderation team	Residency is not an EU-only guarantee — read the carve-outs carefully
Annexes	Annex I (parties, transfer description, supervisory authority), Annex II (TOMs)	Annex I lists audio/video recordings and text input as data categories; sensitive data: N/A

Two details deserve attention when you review the document yourself. First, the SCC module selection is explicit: controller-to-processor, or processor-to-processor where you process for a third-party controller, with the docking clause (Clause 7) excluded and the Clause 9(a) notification period tied to the 30-day subprocessor notice. Second, Annex I designates the supervisory authority of the EEA Member State where the data exporter is established — for German companies, that is regularly one of the German state data protection authorities (Datenschutzaufsichtsbehörden).

GDPR Procurement Guidance for the ElevenLabs DPA

The ElevenLabs DPA covers the contractual baseline, but procurement teams should read it against five practical questions.

Roles and instructions. ElevenLabs acts as processor; your organisation acts as controller — or as processor for your own clients. That allocation only works if your instructions are actually documented: the Terms of Service deem business-entity accounts the controller for personal data in account content, so configure the workspace deliberately, restrict who may upload what, and record the processing purpose in your Article 30 register of processing activities.

Contracting party and governing law. German companies contract with Eleven Labs Inc., New York — the EEA version of the Terms keeps the US entity as the contracting party for European customers, with New York law and exclusive jurisdiction in New York City for businesses. The DPA’s SCC layer, by contrast, is governed by Irish law with Irish courts. The practical effect for your vendor file: contract claims under the main terms sit in New York, while the transfer machinery sits under Irish law — document both layers.

International transfers. The SCCs are deemed executed when the DPA takes effect, and ElevenLabs may also rely on adequacy decisions including the EU-US Data Privacy Framework. The transfer analysis remains yours: map which countries can receive data in your workflow, review the subprocessor list, and run a Transfer Impact Assessment where data sensitivity warrants it.

Sensitive and voice data. Annex I states that sensitive data transferred is “N/A” — and the EEA Terms of Service go further by prohibiting upload of Article 9 GDPR data entirely. Voice is the borderline case: a voice recording is personal data, and it becomes biometric data when processed to uniquely identify a natural person. Standard text-to-speech and voiceover workflows generally stay outside Article 9; speaker identification or voice-verification use cases do not, and the EEA terms’ prohibition means the DPA will not carry them.

AI training boundary. The Terms grant ElevenLabs a broad, perpetual license to your content — including use to improve its models — but you can opt out of training use at any time via the “Data use” menu in your account. Note the division of labour: the DPA governs personal data processing, while the training boundary sits in the license terms. Set the opt-out, document the configuration, and re-verify it after account changes.

One more scoping point: §13 offers data residency on request, subject to ElevenLabs’ discretion, but even a selected residency does not prevent processing outside the region by subprocessors, support staff, or the moderation team. If EU-only processing is a hard requirement for your organisation, get the actual scope confirmed in writing before rollout. See our Claude DPA for a vendor that handles residency differently, and our Anthropic DPA analysis for the portal-gated access model this page contrasts with.

Article 28 GDPR Checklist for the ElevenLabs DPA

Work through these steps before production use, and keep the evidence in your vendor management file:

1. Confirm role allocation. Record that ElevenLabs processes as processor under the DPA and that your organisation remains controller for the defined workflow — or processor vis-à-vis your own clients, with their authorizations on file.
2. Verify the Pflichtinhalte. Check each Article 28(3) element against the clause index above — instructions, confidentiality, security, subprocessors, data subject rights, breach notification, deletion, and audits are all addressed.
3. Document transfers. Record the SCC incorporation (Irish law, Irish courts), the adequacy and Data Privacy Framework reliance, and the transfer paths in your Article 30 register; run a Transfer Impact Assessment where warranted.
4. Set up subprocessor monitoring. Calendar the 30-day notice window against the compliance.elevenlabs.io list, decide internally who assesses new subprocessors, and document the objection pathway.
5. Close the gaps the DPA cannot. Establish your legal basis, complete a DPIA where required, involve the works council (Betriebsrat) for team-wide rollouts with usage analytics, and document the training opt-out configuration.

How to Obtain and Sign the ElevenLabs DPA

ElevenLabs follows a public, self-executing model — a contrast worth knowing if you have dealt with portal-gated vendor DPAs. There is no login, no request form, and no countersignature: the Terms of Service incorporate the DPA as supplemental terms, and the incorporation takes effect for business-entity accounts by use of the service.

Four steps for your records:

1. Open the current DPA at elevenlabs.io/dpa and save a dated copy (version of April 8, 2026 at the time of writing) in your vendor file.
2. Record the incorporation. Cite the Terms of Service supplemental-terms clause in your documentation so the DPA’s legal basis is traceable in your records of processing activities.
3. Pull the compliance pack. Download the subprocessor list and the technical and organizational measures from compliance.elevenlabs.io, and request the current SOC 2 Type II report as your audit evidence.
4. Activate your side. Calendar the 30-day subprocessor objection window, set the training opt-out in the account’s “Data use” menu, and record the version and access date in your vendor register.

The free plan is the exception worth flagging in procurement: free accounts are licensed for non-commercial use only, so any business processing of personal data belongs on a paid plan where the DPA practice described here actually operates.

When the ElevenLabs DPA Is Not Enough

A DPA in place is the entry ticket, not the finish line. A deeper legal review is regularly required where:

• the workflow involves speaker identification or voice verification — voice used for unique identification is biometric data under Article 9 GDPR, and the EEA terms prohibit uploading it
• your policy requires EU-only data residency as a guarantee — §13 is discretionary and carved out for subprocessors, support, and moderation access
• voice cloning touches personality rights of identifiable speakers beyond data protection — consent chains and licensing need separate review
• the deployment must satisfy EU AI Act transparency or risk-management duties alongside GDPR
• sector-specific rules apply, for example in financial services, healthcare, or regulated advice

In these scenarios, the DPA is one exhibit in a larger file covering legal basis, processing architecture, transfer mechanism, and internal governance.

Compound Law advises businesses, founders, and in-house teams in Germany on GDPR compliance, commercial contracts, and AI procurement. If you want the ElevenLabs DPA — or another AI vendor agreement — reviewed before rollout, contact us.