--- title: "Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany" description: "Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/elevenlabs-dpa/" language: "en" --- ![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp) tools # Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany 27 October 2026 Does ElevenLabs offer a DPA? Yes. ElevenLabs publishes its Data Processing Addendum at elevenlabs.io/dpa. It forms part of the ElevenLabs terms, includes EU Standard Contractual Clauses governed by Irish law, and applies whenever ElevenLabs processes personal data contained in your content on your documented instructions. - The DPA is a public document at elevenlabs.io/dpa — no login or signature flow, and the SCCs are incorporated automatically. - German buyers contract with Eleven Labs Inc., New York; the SCC layer is governed by Irish law, the main terms by New York law. - Enterprise content is deleted within 30 days of termination; self-serve deletion only applies after 180 days of inactivity. Yes — ElevenLabs offers a Data Processing Agreement. The **ElevenLabs DPA** is published as a public web page at elevenlabs.io/dpa (version dated April 8, 2026), forms part of the ElevenLabs terms, and applies whenever ElevenLabs processes personal data contained in your content — audio, video, or text — on your documented instructions. This page reviews the **ElevenLabs DPA** as a procurement document for German companies: what each clause covers, where it meets **Article 28 GDPR**, and where your organisation needs to add compliance work of its own. It provides general information, not legal advice for a specific situation. For the structured vendor-selection frame around this document, see our [GDPR AI procurement guide](https://compound.law/en-DE/compliance/gdpr-ai-procurement/); for the broader tool assessment, see our [ElevenLabs review](https://compound.law/en-DE/tools/elevenlabs/). ## What the ElevenLabs DPA Covers: Clause-Level Index ElevenLabs structures the DPA into thirteen numbered sections plus two annexes. The document governs ElevenLabs’ processing of “Customer Personal Data” — personal data contained in the audio, video, and text content you upload — and sets out the parties, the transfer description, and the security measures in Annexes I and II. The table below maps the clause structure so procurement and privacy teams can navigate the document quickly. | Clause | What it covers | Procurement note | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | | §1 Definitions | ”Applicable Data Protection Laws” spans the EU GDPR and e-Privacy Directive, UK and Swiss law, the CCPA, and Brazil’s LGPD; defines the EEA SCCs, UK Addendum, and Brazil SCCs | Confirms the EU GDPR is directly addressed, not just US privacy law | | §2 Scope | Applies when ElevenLabs processes Customer Personal Data as processor; the customer may act as controller or as processor for a third-party controller | Covers agency use — agencies processing for their own clients must hold the necessary authorizations | | §3 Instructions | Processing only on the documented instructions set out in the agreement; duty to flag conflicting legal obligations | Your contract documents and configuration are the instruction set — keep them precise | | §4 Personnel | Confidentiality obligations and need-to-know access for employees, agents, and contractors | Matches Article 28(3)(b) GDPR | | §5 Security | Technical and organizational measures per Annex II, published at compliance.elevenlabs.io | TOMs may be updated by publication — monitor the trust center | | §6 Subprocessing | General authorization; subprocessor list at compliance.elevenlabs.io; 30 days’ notice by list update; objection within the notice period; termination right if unresolved | The objection window runs inside the 30-day notice period — assign an owner before rollout | | §7 Data subject rights | Assistance with access, rectification, and erasure requests; data subject requests are forwarded to you | Matches Article 28(3)(e) GDPR | | §8 Breach | Notification without undue delay after confirming a Security Incident, plus cooperation on your reporting duties | The trigger is confirmation, not mere awareness — note this in your incident runbook | | §9 Deletion and return | DPA terminates with the agreement; enterprise services: deletion within 30 days of termination; self-serve services: optional deletion after 180 days of inactivity; backup carve-out | The self-serve deletion right is discretionary — document your retention position explicitly | | §10 Audit | A current third-party audit certification or report — such as a SOC 2 Type II — satisfies audit rights; virtual audits by mutual agreement at customer cost absent material breach; DPIA assistance | Audit access is report-based — request the SOC 2 report before rollout | | §11 Transfers | Adequacy decisions including the EU-US Data Privacy Framework; EEA SCCs (controller-to-processor or processor-to-processor module); Clause 17 Option 1: Irish law; Clause 18(b): Irish courts; UK Addendum and Swiss FADP adaptations | The SCCs are deemed executed automatically — no signature action needed from you | | §12 US privacy law | CCPA no-sell and no-share commitments | Relevant for US-facing deployments | | §13 Data residency | Optional residency on request, subject to ElevenLabs’ discretion; carve-outs for subprocessors, support access, and the moderation team | Residency is not an EU-only guarantee — read the carve-outs carefully | | Annexes | Annex I (parties, transfer description, supervisory authority), Annex II (TOMs) | Annex I lists audio/video recordings and text input as data categories; sensitive data: N/A | Two details deserve attention when you review the document yourself. First, the SCC module selection is explicit: controller-to-processor, or processor-to-processor where you process for a third-party controller, with the docking clause (Clause 7) excluded and the Clause 9(a) notification period tied to the 30-day subprocessor notice. Second, Annex I designates the supervisory authority of the EEA Member State where the data exporter is established — for German companies, that is regularly one of the German state data protection authorities (Datenschutzaufsichtsbehörden). ## GDPR Procurement Guidance for the ElevenLabs DPA The ElevenLabs DPA covers the contractual baseline, but procurement teams should read it against five practical questions. **Roles and instructions.** ElevenLabs acts as processor; your organisation acts as controller — or as processor for your own clients. That allocation only works if your instructions are actually documented: the Terms of Service deem business-entity accounts the controller for personal data in account content, so configure the workspace deliberately, restrict who may upload what, and record the processing purpose in your Article 30 register of processing activities. **Contracting party and governing law.** German companies contract with **Eleven Labs Inc.**, New York — the EEA version of the Terms keeps the US entity as the contracting party for European customers, with New York law and exclusive jurisdiction in New York City for businesses. The DPA’s SCC layer, by contrast, is governed by Irish law with Irish courts. The practical effect for your vendor file: contract claims under the main terms sit in New York, while the transfer machinery sits under Irish law — document both layers. **International transfers.** The SCCs are deemed executed when the DPA takes effect, and ElevenLabs may also rely on adequacy decisions including the EU-US Data Privacy Framework. The transfer analysis remains yours: map which countries can receive data in your workflow, review the [subprocessor list](https://compliance.elevenlabs.io/), and run a Transfer Impact Assessment where data sensitivity warrants it. **Sensitive and voice data.** Annex I states that sensitive data transferred is “N/A” — and the EEA Terms of Service go further by prohibiting upload of Article 9 GDPR data entirely. Voice is the borderline case: a voice recording is personal data, and it becomes **biometric data** when processed to uniquely identify a natural person. Standard text-to-speech and voiceover workflows generally stay outside Article 9; speaker identification or voice-verification use cases do not, and the EEA terms’ prohibition means the DPA will not carry them. **AI training boundary.** The Terms grant ElevenLabs a broad, perpetual license to your content — including use to improve its models — but you can opt out of training use at any time via the “Data use” menu in your account. Note the division of labour: the DPA governs personal data processing, while the training boundary sits in the license terms. Set the opt-out, document the configuration, and re-verify it after account changes. One more scoping point: §13 offers **data residency** on request, subject to ElevenLabs’ discretion, but even a selected residency does not prevent processing outside the region by subprocessors, support staff, or the moderation team. If EU-only processing is a hard requirement for your organisation, get the actual scope confirmed in writing before rollout. See our [Claude DPA](https://compound.law/en-DE/tools/claude-dpa/) for a vendor that handles residency differently, and our [Anthropic DPA analysis](https://compound.law/en-DE/tools/anthropic-dpa/) for the portal-gated access model this page contrasts with. ## Article 28 GDPR Checklist for the ElevenLabs DPA Work through these steps before production use, and keep the evidence in your vendor management file: 1. **Confirm role allocation.** Record that ElevenLabs processes as processor under the DPA and that your organisation remains controller for the defined workflow — or processor vis-à-vis your own clients, with their authorizations on file. 2. **Verify the Pflichtinhalte.** Check each Article 28(3) element against the clause index above — instructions, confidentiality, security, subprocessors, data subject rights, breach notification, deletion, and audits are all addressed. 3. **Document transfers.** Record the SCC incorporation (Irish law, Irish courts), the adequacy and Data Privacy Framework reliance, and the transfer paths in your Article 30 register; run a Transfer Impact Assessment where warranted. 4. **Set up subprocessor monitoring.** Calendar the 30-day notice window against the compliance.elevenlabs.io list, decide internally who assesses new subprocessors, and document the objection pathway. 5. **Close the gaps the DPA cannot.** Establish your legal basis, complete a DPIA where required, involve the works council (Betriebsrat) for team-wide rollouts with usage analytics, and document the training opt-out configuration. ## How to Obtain and Sign the ElevenLabs DPA ElevenLabs follows a **public, self-executing model** — a contrast worth knowing if you have dealt with portal-gated vendor DPAs. There is no login, no request form, and no countersignature: the Terms of Service incorporate the DPA as supplemental terms, and the incorporation takes effect for business-entity accounts by use of the service. **Four steps for your records:** 1. **Open the current DPA** at [elevenlabs.io/dpa](https://elevenlabs.io/dpa) and save a dated copy (version of April 8, 2026 at the time of writing) in your vendor file. 2. **Record the incorporation.** Cite the Terms of Service supplemental-terms clause in your documentation so the DPA’s legal basis is traceable in your records of processing activities. 3. **Pull the compliance pack.** Download the subprocessor list and the technical and organizational measures from [compliance.elevenlabs.io](https://compliance.elevenlabs.io/), and request the current SOC 2 Type II report as your audit evidence. 4. **Activate your side.** Calendar the 30-day subprocessor objection window, set the training opt-out in the account’s “Data use” menu, and record the version and access date in your vendor register. The free plan is the exception worth flagging in procurement: free accounts are licensed for non-commercial use only, so any business processing of personal data belongs on a paid plan where the DPA practice described here actually operates. ## When the ElevenLabs DPA Is Not Enough A DPA in place is the entry ticket, not the finish line. A deeper legal review is regularly required where: - the workflow involves **speaker identification or voice verification** — voice used for unique identification is biometric data under Article 9 GDPR, and the EEA terms prohibit uploading it - your policy requires **EU-only data residency** as a guarantee — §13 is discretionary and carved out for subprocessors, support, and moderation access - voice cloning touches **personality rights** of identifiable speakers beyond data protection — consent chains and licensing need separate review - the deployment must satisfy **EU AI Act** transparency or risk-management duties alongside GDPR - sector-specific rules apply, for example in financial services, healthcare, or regulated advice In these scenarios, the DPA is one exhibit in a larger file covering legal basis, processing architecture, transfer mechanism, and internal governance. Compound Law advises businesses, founders, and in-house teams in Germany on **GDPR compliance, commercial contracts, and AI procurement**. If you want the ElevenLabs DPA — or another AI vendor agreement — reviewed before rollout, [contact us](https://compound.law/en-DE/#booking). ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) [![Claude ZDR zero data retention guide for Anthropic API and Claude Code enterprise use](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-zdr/) [tools](https://compound.law/en-DE/tools/claude-zdr/) ### [Claude ZDR: What It Covers, Who Qualifies, How to Get It](https://compound.law/en-DE/tools/claude-zdr/) [Claude ZDR is available for the Anthropic API and Claude Code. See which plans qualify, what's excluded, and how to request enablement for your organization.](https://compound.law/en-DE/tools/claude-zdr/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) - [Claude Team Plan DPA & GDPR Compliance Guide tools](https://compound.law/en-DE/tools/claude-team-gdpr/) ## Frequently asked questions Yes. ElevenLabs publishes a Data Processing Addendum as a public web page at elevenlabs.io/dpa (dated April 8, 2026 at the time of writing). It becomes part of the agreement via the supplemental terms mechanism in the Terms of Service and applies whenever ElevenLabs processes personal data in customer content as a processor. No signature or login is required. In principle, yes. The DPA addresses the mandatory Article 28(3) content: instructions, confidentiality, security, subprocessor oversight, data subject rights assistance, breach notification, deletion, and audit rights. Whether it suffices depends on mapping roles, data categories, transfer paths, and subprocessor mechanics to your actual ElevenLabs workflow — especially for voice use cases. No. The DPA forms part of the agreement through the supplemental terms mechanism: registering on behalf of an entity means the Terms state that the DPA governs ElevenLabs' processing of personal data in your content. There is no separate signature step. Instead, save a dated copy, record the version in your vendor register, and document the incorporation. The DPA is publicly accessible at elevenlabs.io/dpa — no account required. The subprocessor list and the technical and organizational measures (Annex II) are published at compliance.elevenlabs.io, where ElevenLabs also maintains its trust center documentation. For audit evidence, request the current SOC 2 Type II report, which the DPA names as the audit-rights substitute. Two layers apply. The DPA incorporates the EU Standard Contractual Clauses with Clause 17, Option 1: Irish governing law, with Irish courts under Clause 18(b). The main Terms of Service, by contrast, are governed by New York law with exclusive jurisdiction in New York City for businesses — including for customers in the EEA, since German companies contract with Eleven Labs Inc., the US entity. The DPA attaches to business-entity accounts through the Terms, but the free plan is licensed for non-commercial use only and does not support business processing of personal data. Paid plans are the procurement-relevant tier — data residency is request-based at ElevenLabs' discretion, and deletion terms differ between enterprise and self-serve services. Several AI vendors publish DPAs that work for German deployments, including ElevenLabs, Anthropic (Claude), OpenAI, and Asana. The differentiators are rarely DPA existence but data residency options, subprocessor objection windows, audit access, and AI training boundaries. Compare the ElevenLabs DPA with the Claude DPA and the Asana DPA, and document the comparison in your procurement file. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany", "description": "Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.", "image": "https://compound.law/assets/images/tools/tools_4.webp", "datePublished": "2026-10-27T00:00:00.000Z", "dateModified": "2026-10-27T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/elevenlabs-dpa/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany", "item": "https://compound.law/en-DE/tools/elevenlabs-dpa/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does ElevenLabs offer a DPA?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. ElevenLabs publishes a Data Processing Addendum as a public web page at elevenlabs.io/dpa (dated April 8, 2026 at the time of writing). It becomes part of the agreement via the supplemental terms mechanism in the Terms of Service and applies whenever ElevenLabs processes personal data in customer content as a processor. No signature or login is required." } }, { "@type": "Question", "name": "Is the ElevenLabs DPA sufficient for Article 28 GDPR?", "acceptedAnswer": { "@type": "Answer", "text": "In principle, yes. The DPA addresses the mandatory Article 28(3) content: instructions, confidentiality, security, subprocessor oversight, data subject rights assistance, breach notification, deletion, and audit rights. Whether it suffices depends on mapping roles, data categories, transfer paths, and subprocessor mechanics to your actual ElevenLabs workflow — especially for voice use cases." } }, { "@type": "Question", "name": "Do I need to sign the ElevenLabs DPA?", "acceptedAnswer": { "@type": "Answer", "text": "No. The DPA forms part of the agreement through the supplemental terms mechanism: registering on behalf of an entity means the Terms state that the DPA governs ElevenLabs' processing of personal data in your content. There is no separate signature step. Instead, save a dated copy, record the version in your vendor register, and document the incorporation." } }, { "@type": "Question", "name": "Where can I download the ElevenLabs DPA?", "acceptedAnswer": { "@type": "Answer", "text": "The DPA is publicly accessible at elevenlabs.io/dpa — no account required. The subprocessor list and the technical and organizational measures (Annex II) are published at compliance.elevenlabs.io, where ElevenLabs also maintains its trust center documentation. For audit evidence, request the current SOC 2 Type II report, which the DPA names as the audit-rights substitute." } }, { "@type": "Question", "name": "Which law governs the ElevenLabs DPA?", "acceptedAnswer": { "@type": "Answer", "text": "Two layers apply. The DPA incorporates the EU Standard Contractual Clauses with Clause 17, Option 1: Irish governing law, with Irish courts under Clause 18(b). The main Terms of Service, by contrast, are governed by New York law with exclusive jurisdiction in New York City for businesses — including for customers in the EEA, since German companies contract with Eleven Labs Inc., the US entity." } }, { "@type": "Question", "name": "Does the ElevenLabs DPA cover the free plan?", "acceptedAnswer": { "@type": "Answer", "text": "The DPA attaches to business-entity accounts through the Terms, but the free plan is licensed for non-commercial use only and does not support business processing of personal data. Paid plans are the procurement-relevant tier — data residency is request-based at ElevenLabs' discretion, and deletion terms differ between enterprise and self-serve services." } }, { "@type": "Question", "name": "Which AI vendors provide DPAs suitable for German companies?", "acceptedAnswer": { "@type": "Answer", "text": "Several AI vendors publish DPAs that work for German deployments, including ElevenLabs, Anthropic (Claude), OpenAI, and Asana. The differentiators are rarely DPA existence but data residency options, subprocessor objection windows, audit access, and AI training boundaries. Compare the ElevenLabs DPA with the Claude DPA and the Asana DPA, and document the comparison in your procurement file." } } ] } ] ```