--- title: "Is ElevenLabs GDPR Compliant? DPA, Data Transfers & Germany" description: "ElevenLabs can support GDPR-compliant use in Germany — but only after reviewing the DPA, verifying data transfers, and assessing your use case." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/elevenlabs/" language: "en" --- ![ElevenLabs DPA and GDPR review for companies in Germany](https://compound.law/assets/images/tools/tools_3.webp) tools # Is ElevenLabs GDPR Compliant? DPA, Data Transfers & Germany 3 April 2026 Can German companies use ElevenLabs lawfully? Yes, in some cases, but only after a structured GDPR review. German buyers should verify the ElevenLabs DPA, transfer setup, EU data residency scope, retention controls, and whether the workflow involves customer calls, employee recordings, or voice biometrics. - ElevenLabs publicly offers a DPA with SCCs, but legal teams still need to review processor terms, subprocessors, and actual data flows. - EU data residency is helpful, yet it does not automatically mean EU-only processing for every support, moderation, or security scenario. - Lower-risk text-to-speech uses are easier to justify than call recordings, voice cloning, employee monitoring, or identification workflows. **ElevenLabs can be used lawfully in Germany** for many AI voice and text-to-speech workflows — but only if your deployment includes a reviewed DPA, a defensible transfer mechanism, and appropriate controls for the data categories involved. **The ElevenLabs DPA is available directly at elevenlabs.io/dpa and applies to all paid plans.** As of 2026, ElevenLabs offers a DPA with SCCs, European data residency, and Zero Retention Mode for some API use cases — but these protections do not make every ElevenLabs workflow GDPR-safe by default. The legal result depends on the contract path, the data you upload, and whether you use the product for low-risk content generation or for higher-risk voice recording, employee monitoring, or voice biometric scenarios. For comparison with other voice and content AI tools, see the [AI tools assessed by Compound Law](https://compound.law/en-DE/tools/). > **Best fit / not fit** > > **Best fit:** scripted marketing voiceovers, product narration, low-sensitivity internal training, or customer content that is redacted, minimized, and covered by a reviewed DPA and transfer setup. > > **Needs legal review:** customer support calls, sales call summaries, cloned brand voices, employee recordings, and any workflow that stores large volumes of identifiable voice data. > > **Usually avoid without a deeper assessment:** voice authentication, profiling, covert monitoring, high-impact HR decisions, or processing special-category data through voice workflows. This page is general information, not legal advice for a specific implementation. If your team is building a broader voice AI stack, also review our guides on [AI voice assistants](https://compound.law/en-DE/compliance/ai-voice-assistants/), [AI customer service](https://compound.law/en-DE/compliance/ai-customer-service/), [Whisper](https://compound.law/en-DE/tools/whisper/), and the [OpenAI API](https://compound.law/en-DE/tools/openai-api/). ## ElevenLabs DPA: How to Access It ElevenLabs publicly provides its Data Processing Agreement at **elevenlabs.io/dpa** — no account or Enterprise plan required. The DPA applies to all paid plans and can be downloaded directly. For additional documentation including the sub-processor list and audit reports, see the Trust Center at **compliance.elevenlabs.io**. The DPA covers ElevenLabs’ role as a processor under Article 28 GDPR, Standard Contractual Clauses (SCCs) for EU-US data transfers, sub-processor obligations, data retention terms, and DPIA support. Note that EU data residency is a separate plan-level feature — the DPA alone does not guarantee EU-only processing for all workflows. For a clause-level procurement review of the current document, see our [ElevenLabs DPA guide](https://compound.law/en-DE/tools/elevenlabs-dpa/). ### What to Check in the ElevenLabs DPA Once you have the DPA, these are the key issues for German companies to verify: - **Processor vs. joint controller role:** confirm which processing activities are covered as pure processor relationships — text-to-speech and voice cloning may be treated differently - **Sub-processor list:** check whether model fine-tuning partners or moderation vendors are listed and whether the objection process is workable - **EU data residency scope:** confirm which processing activities fall under the EU residency setting and which may still involve cross-border access, especially support and moderation - **Zero Retention Mode:** only available on higher API tiers — verify before relying on it as a privacy control - **Retention periods:** voice recordings and generated audio may follow different schedules — confirm defaults and deletion triggers - **Special category data:** any use case involving voice identification, biometrics, or sensitive contexts requires a separate legal basis analysis beyond the DPA ## ElevenLabs DPA and Compliance Updates (2026) ElevenLabs continues to evolve its compliance posture in response to EU regulatory developments. For German procurement teams, the most relevant 2026 developments to verify are: - **EU AI Act transparency:** ElevenLabs’ text-to-speech and voice cloning features fall under Article 50 EU AI Act, which requires disclosure when content is AI-generated. Confirm that your deployment implements the required user disclosures before going live. - **DPA version:** ElevenLabs maintains its public DPA at elevenlabs.io/dpa. Always download and review the current version at time of procurement — do not rely on cached copies or descriptions from earlier in a sales process. - **Subprocessor updates:** The subprocessor list at compliance.elevenlabs.io is updated periodically. Confirm the current list and review any new additions against your internal data governance standards and DPA objection windows. - **Enterprise controls:** ElevenLabs has expanded enterprise-tier controls, including Zero Retention Mode and configurable data residency. Verify which plan tier unlocks which controls for your planned deployment before signing off. As with any SaaS procurement, the compliance status at the time of DPA signature matters. German legal teams should verify current terms directly with ElevenLabs and document the vendor confirmation in writing. ## Is ElevenLabs GDPR compliant? In Germany, the better question is not whether ElevenLabs is “GDPR compliant” in the abstract. The real question is whether **your planned ElevenLabs deployment** is defensible under the GDPR. For most buyers, the first legal checkpoints are: 1. Is ElevenLabs acting as a **processor** under **Article 28 GDPR**, or are any parts of the service outside that processor role? 2. What categories of data go into the service: simple script text, recorded customer calls, employee audio, cloned voices, or special-category data? 3. Does the workflow create a transfer issue under **Chapter V GDPR**, even if the vendor offers European data residency? 4. What retention, deletion, and training settings apply to the exact product tier and API path you use? 5. Does the use case trigger other issues under labor law, confidentiality obligations, or the **EU AI Act**? For lower-risk uses, ElevenLabs can often be workable. Typical examples include: - scripted voiceovers from non-sensitive text - product demos and accessibility narration - training content using approved synthetic voices - limited customer communications with clear disclosures and human review The position becomes stricter once the workflow involves: - recorded customer support calls - sales conversations containing free-form personal data - employee speech, call monitoring, or training evaluation - realistic voice cloning linked to identifiable people - sensitive sectors such as health, insurance, or employment That distinction matters because the main risk is usually not the model name. It is the **combination of voice data, retention, transfers, and actual business use**. ## Does ElevenLabs offer a DPA and what should legal review? Yes. ElevenLabs publicly provides a **Data Processing Addendum (DPA)**. Its DPA states that it applies where ElevenLabs processes customer personal data as a processor, and it includes provisions on subprocessors, audits, SCCs, and DPIA support. That is a meaningful starting point, but not the end of the review. Legal and privacy teams should still check at least the following: | Issue | Why it matters | What legal should verify | | ---------------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | | Processor role | GDPR obligations change if the vendor is not acting purely on your instructions | Match the DPA and product terms to the concrete workflow | | Article 28 terms | A DPA alone is not enough if the clause set is weak or too generic | Review instructions, deletion, confidentiality, audits, and assistance language | | Subprocessors | Voice workflows often rely on cloud and support vendors | Review the subprocessor list and objection process | | Transfers | Even with residency options, cross-border processing can still happen | Verify SCCs, DPF references, and any supplementary controls | | Retention and deletion | Voice data is easy to keep longer than teams expect | Confirm default retention, deletion triggers, backups, and logs | ElevenLabs’ public DPA also says customers must provide any required notice and obtain any necessary consent for the processing. That matters in practice. If you use ElevenLabs for customer or employee recordings, you cannot outsource your own transparency and lawful-basis analysis to the vendor. For German buyers, the contract review usually needs to answer three specific questions: 1. Is the DPA sufficient for the exact ElevenLabs product path you are buying? 2. Are you comfortable with the transfer model for the planned data types? 3. Do your internal rules prohibit certain content even if the vendor contract is acceptable? ## European data residency and transfer implications ElevenLabs publicly announced **European data residency** and also publishes a DPA that relies on adequacy decisions, the **EU-U.S. Data Privacy Framework**, and **SCCs** where relevant. That is helpful, especially for German procurement teams that want a clearer hosting story than a generic U.S.-only SaaS setup. But legal teams should not treat “EU data residency” as shorthand for “no transfer risk.” The main reasons are practical: - the public privacy material still references cloud and support operations involving countries outside the EEA - the DPA allows transfer mechanisms such as SCCs and DPF where relevant - the DPA notes that the moderation team may access customer personal data from outside the data residency location to enforce use policies So the right procurement question is: **What exactly stays in the EU, and what may still be processed, accessed, or supported from outside the EEA?** For many companies, the safest approach is to document the answer in writing before rollout. Ask for confirmation on: - where the relevant audio, text, and generated outputs are stored - whether support or moderation access can occur from outside the EEA - which logs are tied to the residency setting - whether any subprocessors outside the EEA are still involved - what transfer mechanism governs any residual extra-EEA processing If your company needs especially strict data minimization, the public ElevenLabs documentation on **Zero Retention Mode** is relevant. ElevenLabs describes Zero Retention Mode as available **only for API requests**, with the service not storing request or response bodies once the API call completes. That can materially reduce risk, but it is not a universal setting for every ElevenLabs workflow or UI product. ## Voice recordings, biometric risk, and sensitive use cases This is the core legal issue for many buyers in Germany. Under the GDPR, **voice recordings are personal data** if they relate to an identifiable person. But they are not automatically **special-category biometric data** under **Article 9 GDPR**. The higher threshold is usually triggered when voice is processed for the purpose of **uniquely identifying** a natural person. That means there is an important distinction between: - using ElevenLabs to generate synthetic speech from approved text - uploading customer or employee recordings for dubbing or transformation - using voice characteristics to identify, authenticate, or profile someone The risk rises quickly in the second and third categories. | Use case | Risk view | Why | | --------------------------------------------------------- | ----------------------------- | ------------------------------------------------------------------- | | Marketing voiceover from approved script | Low-risk | Limited personal data, easy to control content | | Product narration or accessibility voice | Low-risk | Usually manageable with basic governance | | Customer support call transcription plus voice generation | Needs legal review | Call data often contains personal data, complaints, and identifiers | | Employee training content using staff recordings | Needs legal review | Employment and consent issues are harder in practice | | Voice cloning of founders, executives, or staff | Needs legal review | Identity, personality rights, and misuse risk increase | | Voice authentication or speaker identification | Avoid without deep assessment | Biometric and high-impact risk rises substantially | If your project touches customer support recordings, sales outreach, or employee content, you should also assess whether the workflow needs a **DPIA** under **Article 35 GDPR**. The ElevenLabs DPA says the vendor will provide commercially reasonable assistance where required for DPIAs and consultations. That is useful, but the obligation to decide whether a DPIA is needed remains yours. In Germany, employee-touching voice AI can also trigger **works council** issues under **section 87(1) no. 6 BetrVG** if the deployment enables monitoring or evaluation of employee behavior or performance. ## Retention, model training, and enterprise controls Retention and training questions are not side issues for ElevenLabs. They are often the deciding factor for whether the tool is acceptable for a given team. ElevenLabs states publicly that, **by default, it does not train on data from Enterprise customers**, other than as necessary to provide the service. That is a useful procurement point, especially for confidential business workflows. Still, legal and privacy teams should go one step further and verify: - whether the non-training position applies to the exact plan and product path you use - whether audio, prompts, and outputs have different retention logic - whether account logs, abuse monitoring, or backup systems follow a separate schedule - whether Zero Retention Mode is available and operationally realistic for your API workflow The public privacy policy also says ElevenLabs will not keep data it generates about a user’s voice longer than **three years after the last interaction**, unless law requires otherwise. That is a useful public indicator, but enterprise buyers should not rely on the privacy policy alone. The DPA, product documentation, sales commitments, and actual system configuration matter more for a business rollout. As a practical matter, German companies should define internal usage rules before procurement sign-off: - no uploading of unnecessary personal data - no employee voice data without explicit approval path - no special-category data unless separately cleared - no “test uploads” of live customer calls into public or unmanaged workspaces ## Can ElevenLabs be used for support, sales, and internal operations? Sometimes, yes. But the answer depends on the type of workflow. ### Support ElevenLabs can fit some customer support workflows, especially where it is used for scripted outbound information, menu narration, or tightly controlled voice generation. It becomes harder when the system processes full call recordings or generates responses from free-form customer inputs. If you deploy ElevenLabs in support, check: - lawful basis and recording notice - AI disclosure under **Article 50 EU AI Act** - transfer and residency setup - retention for recordings and outputs - handoff to human agents for edge cases For a broader support analysis, see our guide to [AI customer service](https://compound.law/en-DE/compliance/ai-customer-service/). ### Sales Sales enablement workflows can be manageable when they use approved scripts, demo content, or synthetic narration that does not depend on sensitive personal data. The risk rises when the tool processes prospect calls, objection recordings, or cloned executive voices for outreach. In those cases, privacy, unfair commercial practices, and reputational risk all need attention. ### Internal operations Internal learning content, product tutorials, and multilingual narration are often easier to justify than external, real-time conversational use. But once employee recordings, workplace analytics, or performance review data enter the picture, German labor-law concerns become significant. For voice-specific transparency questions, also review our [AI voice assistants](https://compound.law/en-DE/compliance/ai-voice-assistants/) guide, and consult our [AI video generation compliance](https://compound.law/en-DE/compliance/ai-video-generation/) page where ElevenLabs outputs are integrated into video production workflows. This is especially relevant for [media and entertainment AI compliance](https://compound.law/en-DE/ai-act/media-entertainment/) teams and those in the [education sector AI adoption in Germany](https://compound.law/en-DE/ai-act/education/) who use synthetic voice for e-learning content. ## Practical compliance checklist If your company is evaluating ElevenLabs now, start with this checklist: 1. **Map the exact product path.** Separate browser workflow, studio workflow, and API workflow. 2. **Classify the data.** Distinguish script text, customer recordings, employee audio, and sensitive data. 3. **Review the ElevenLabs DPA.** Check processor clauses, SCCs, subprocessor process, and deletion language. 4. **Verify residency in writing.** Confirm what the EU data residency setting covers and what it does not. 5. **Assess retention and training.** Confirm whether Zero Retention Mode or other controls are available for your deployment. 6. **Check AI Act transparency.** If people interact with synthetic or conversational AI, plan clear disclosure from the start. 7. **Assess labor-law and DPIA risk.** Escalate employee monitoring, call analytics, and identification scenarios early. 8. **Set internal upload rules.** Do not wait for end users to invent the data-governance model. That checklist is often enough to separate a workable ElevenLabs rollout from one that should be paused. ## ElevenLabs vs. Alternatives for German Companies If your team is comparing voice AI tools for GDPR compliance in Germany, the key differentiators are DPA availability, EU data residency, Zero Retention Mode for API workflows, and the degree of enterprise-tier control over subprocessors and retention. ElevenLabs covers all of these, but the right choice depends on your specific use case. | Tool | DPA available | EU data residency | Zero retention option | Best for | | ---------------------- | -------------------- | -------------------- | --------------------- | --------------------------------------------- | | ElevenLabs | Yes (all paid plans) | Yes (plan-dependent) | Yes (API only) | High-quality TTS, voice cloning, dubbing | | OpenAI TTS / Whisper | Yes (via OpenAI DPA) | Limited | No | Transcription, STT, general TTS | | Deepgram | Yes | Yes | Yes (API) | Real-time STT, call analytics | | Azure Cognitive Speech | Yes (via Azure DPA) | Yes (EU regions) | Configurable | Enterprise STT/TTS with strict data residency | For German companies with strict data minimization requirements, the deciding factor is often Zero Retention Mode (ElevenLabs API tier) or configurable deletion in an enterprise cloud platform. Related compliance guides: - [Whisper GDPR compliance for Germany](https://compound.law/en-DE/tools/whisper/) — for transcription and speech-to-text workflows - [OpenAI API GDPR review](https://compound.law/en-DE/tools/openai-api/) — if you are evaluating the full OpenAI stack - [AI customer service compliance](https://compound.law/en-DE/compliance/ai-customer-service/) — for voice bots and automated support deployments - [AI voice assistants compliance](https://compound.law/en-DE/compliance/ai-voice-assistants/) — for assistant and IVR use cases ## FAQ ### What is the ElevenLabs DPA? It is the vendor’s public Data Processing Addendum for customer personal data. For German buyers, the relevant point is not just that the DPA exists, but whether it fits the exact ElevenLabs deployment, data types, and transfer path your business plans to use. ### Is ElevenLabs GDPR compliant in Germany? ElevenLabs can support GDPR-compliant use in Germany, but only if the deployment has a valid legal basis, a reviewed DPA, a defensible transfer setup, suitable retention controls, and strict limits on sensitive voice workflows. ### Does ElevenLabs offer an AVV or only a DPA? For German buyers, the practical equivalent of an **AVV** is the vendor’s DPA if it satisfies **Article 28 GDPR**. The label matters less than whether the contract actually covers instructions, subprocessors, deletion, security, and audit support. ### Do we need consent for all ElevenLabs use cases? No. The legal basis depends on the workflow. Some uses may rely on contract performance or legitimate interests, but recorded calls, employee data, cloned voices, or sensitive contexts can require a much stricter analysis and sometimes consent. ### Should companies use ElevenLabs for voice biometrics or employee monitoring? Not without a deeper legal assessment. Those use cases raise significantly higher GDPR, labor-law, and AI governance risk than ordinary text-to-speech or content narration. ### Where can I download the ElevenLabs DPA? The ElevenLabs DPA is publicly accessible at elevenlabs.io/dpa — no login or Enterprise account required. The Trust Center at compliance.elevenlabs.io has additional documentation including the sub-processor list and audit reports. ### Does the ElevenLabs DPA cover EU data residency? The DPA references SCCs for data transfers, but EU data residency is a separate plan-level feature. Confirm that your specific tier includes EU-only processing before relying on the DPA alone to cover your transfer risk. ### Is ElevenLabs safe to use in Germany? ElevenLabs is safe to use in Germany for low-risk text-to-speech and scripted content workflows, provided your team has reviewed the DPA, confirmed EU data residency applies to your plan, and verified that the deployment does not involve customer call recordings, voice biometric processing, or employee monitoring. Higher-risk workflows require a formal legal and DPIA assessment before rollout. ### What ElevenLabs plan do I need for GDPR compliance? Any paid ElevenLabs plan provides access to the DPA, which is the minimum requirement for a lawful processor relationship under Article 28 GDPR. EU data residency and Zero Retention Mode are available on higher tiers — Enterprise for the most comprehensive controls. Verify which tier your use case requires before finalizing procurement. The DPA alone does not guarantee EU-only processing; residency and retention settings must be actively configured for your account. If your team is reviewing ElevenLabs, voice AI vendors, or customer-service automation before procurement, Compound Law advises businesses in Germany on **GDPR, AI procurement, commercial contracts, and workplace AI governance**. [Contact us](https://compound.law/en-DE/#booking) if you need a vendor review, DPA review, or rollout checklist for a concrete voice AI use case. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Yes. ElevenLabs publishes a DPA and says SCCs are incorporated where relevant, but buyers should still review the processor setup, transfer language, subprocessor list, and retention terms for the exact deployment. ElevenLabs can support GDPR-compliant use, but compliance depends on your use case, legal basis, DPA terms, transfer mechanism, retention settings, and the categories of data uploaded to the service. Yes, ElevenLabs publicly offers European data residency, but buyers should confirm in writing what stays in-region and whether support, moderation, logs, or subprocessors can still create extra-EEA processing. No. Voice data is not automatically special-category biometric data. The risk increases when voice is processed to uniquely identify a person, or when the workflow involves health, HR, or other sensitive contexts. ElevenLabs is safe to use in Germany for low-risk text-to-speech and scripted content workflows, provided the DPA is reviewed, EU data residency is confirmed, and the use case does not involve customer recordings, biometric processing, or employee monitoring. Any paid ElevenLabs plan includes access to the DPA. EU data residency and Zero Retention Mode are separate features available on higher tiers — verify which tier your deployment requires before signing off on procurement. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Is ElevenLabs GDPR Compliant? DPA, Data Transfers & Germany", "description": "ElevenLabs can support GDPR-compliant use in Germany — but only after reviewing the DPA, verifying data transfers, and assessing your use case.", "image": "https://compound.law/assets/images/tools/tools_3.webp", "datePublished": "2026-04-03T00:00:00.000Z", "dateModified": "2026-04-03T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/elevenlabs/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Is ElevenLabs GDPR Compliant? DPA, Data Transfers & Germany", "item": "https://compound.law/en-DE/tools/elevenlabs/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does ElevenLabs offer a DPA for business customers?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. ElevenLabs publishes a DPA and says SCCs are incorporated where relevant, but buyers should still review the processor setup, transfer language, subprocessor list, and retention terms for the exact deployment." } }, { "@type": "Question", "name": "Is ElevenLabs GDPR compliant in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "ElevenLabs can support GDPR-compliant use, but compliance depends on your use case, legal basis, DPA terms, transfer mechanism, retention settings, and the categories of data uploaded to the service." } }, { "@type": "Question", "name": "Does ElevenLabs provide EU data residency?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, ElevenLabs publicly offers European data residency, but buyers should confirm in writing what stays in-region and whether support, moderation, logs, or subprocessors can still create extra-EEA processing." } }, { "@type": "Question", "name": "Is voice data automatically biometric data under the GDPR?", "acceptedAnswer": { "@type": "Answer", "text": "No. Voice data is not automatically special-category biometric data. The risk increases when voice is processed to uniquely identify a person, or when the workflow involves health, HR, or other sensitive contexts." } }, { "@type": "Question", "name": "Is ElevenLabs safe to use in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "ElevenLabs is safe to use in Germany for low-risk text-to-speech and scripted content workflows, provided the DPA is reviewed, EU data residency is confirmed, and the use case does not involve customer recordings, biometric processing, or employee monitoring." } }, { "@type": "Question", "name": "What ElevenLabs plan do I need for GDPR compliance?", "acceptedAnswer": { "@type": "Answer", "text": "Any paid ElevenLabs plan includes access to the DPA. EU data residency and Zero Retention Mode are separate features available on higher tiers — verify which tier your deployment requires before signing off on procurement." } } ] } ] ```