--- title: "Figma DPA: Does Figma Have a Data Processing Agreement for GDPR?" description: "Figma offers a DPA for Organization and Enterprise plans. Learn what German companies must check before using Figma and Figma AI under GDPR." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/figma-ai/" language: "en" --- ![Figma DPA and GDPR compliance for German companies](https://compound.law/assets/images/tools/tools_4.webp) tools # Figma DPA: Does Figma Have a Data Processing Agreement for GDPR? 7 April 2026 Does Figma have a Data Processing Agreement for GDPR? Yes — Figma provides a Data Processing Agreement, but only for Organization and Enterprise plan customers. German companies on Starter or Professional plans have no DPA coverage and must upgrade before processing personal data through Figma. - Figma's DPA covers Organization and Enterprise plans only. Starter and Professional plan users are not covered. - Figma AI features (introduced 2024) do not use customer content to train AI models, but data is processed via US-based infrastructure. - Design files often contain personal data — photographs, user research, mockups with real names. This makes DPA coverage legally required under GDPR Article 28. - No EU-only data residency is available for non-Enterprise customers. Standard Contractual Clauses cover international transfers. **Yes, Figma does have a Data Processing Agreement (DPA) — but it is only available on Figma Organization and Figma Enterprise plans.** German companies evaluating Figma under GDPR need to go beyond DPA availability: AI feature data flows, the absence of EU-only data residency on lower plans, and works council obligations all require attention before deployment. ## What is Figma? Figma is a cloud-based collaborative design platform headquartered in San Francisco, California. It provides vector design tools, prototyping, and real-time collaboration for product and marketing teams. In 2024, Figma introduced **Figma AI** — a suite of AI-powered features including AI-assisted layout generation, content drafting, design suggestions, and background removal. **FigJam**, Figma’s online whiteboard product, similarly introduced AI-powered features for brainstorming and diagramming. Because Figma processes design content — which routinely includes photographs, user research data, and mockups containing personal data — on behalf of business customers, it functions as a **data processor** under GDPR Article 28. A valid Data Processing Agreement is legally required before processing personal data through the platform in a professional context. ## Is Figma GDPR-Compliant? Figma can be used in a GDPR-compliant manner with the correct plan and contractual setup. The free Starter plan and the Professional plan do not include a DPA and are not suitable for processing personal data in a business context under GDPR. Key points for German companies: - **DPA availability:** Available on Figma Organization and Figma Enterprise plans. Starter and Professional plan users have no DPA coverage. - **AI training data:** Figma states it does not use customer content — design files, prototypes, or FigJam boards — to train AI models. This applies to all paid plans. - **Data residency:** Figma uses AWS as its primary infrastructure. No EU-only data residency is available as a standard feature. Enterprise customers should negotiate data residency terms directly with Figma. - **Sub-processors:** Figma maintains a published sub-processor list, including AWS for hosting and various vendors for analytics and support. AI infrastructure providers are included as sub-processors when Figma AI features are used. - **Standard Contractual Clauses:** Figma includes SCCs in its DPA for transfers of personal data from the EU/EEA to the United States. ## Does Figma Have a DPA? Yes. Figma provides a Data Processing Agreement for Organization and Enterprise customers. The DPA covers Figma’s processing of personal data on behalf of the business customer, including data processed through Figma AI features. For German companies, the DPA is the starting point, not the finish line. You also need to: 1. Confirm that **Standard Contractual Clauses** are in place for transfers to Figma (US) and its AWS-based sub-processors. 2. Update your **records of processing activities** (Verzeichnis von Verarbeitungstätigkeiten, Article 30 DSGVO) to include Figma. 3. Conduct a **Data Protection Impact Assessment (DPIA)** if Figma will process sensitive personal data — for example, user research involving special category data, or design files containing photographs of identifiable individuals. 4. Review sub-processor notifications — Figma notifies customers of sub-processor changes; ensure your internal process captures these updates. Compare this with [Canva](https://compound.law/en-DE/tools/canva-ai/), which similarly offers DPA coverage only on paid plans (Teams and Enterprise) and uses SCCs for EU-US data transfers. For Adobe’s design tools, see our [Adobe Firefly compliance guide](https://compound.law/en-DE/tools/adobe-firefly/). ## Figma AI Features and Data Processing Figma AI, introduced at Config 2024, adds AI-assisted capabilities directly within the design editor. These features introduce additional data protection considerations beyond standard file storage: **AI design tools** (layout suggestions, content fill, design generation) process the content of design frames — including images, text, and structure — to generate AI outputs. This content is sent to Figma’s AI infrastructure for processing. **AI content drafting** generates copy suggestions based on design context. Text, labels, and placeholder content in a design frame may be included as prompt context sent to Figma’s AI models. **FigJam AI** offers AI-powered clustering, summarisation, and diagramming. FigJam boards may contain meeting notes, user research, strategy documents, and other content that could include personal data. **Key data protection point:** Figma states it does not use customer content to train AI models. Individual AI features can typically be toggled at the organisation level on Organization and Enterprise plans. If your compliance assessment concludes that specific AI features are not appropriate for your use case, verify that these can be disabled and document that decision in your records of processing activities. ## Data Residency and International Data Transfers Figma is headquartered in San Francisco and runs its infrastructure primarily on **Amazon Web Services (AWS)**. European customer data is stored and processed on AWS — including infrastructure in the United States. This means personal data processed through Figma is subject to international transfers under GDPR Chapter V. **Sub-processor chain (representative):** | Entity | Role | Location | | ----------------------- | ------------------------------------- | ---------------------- | | Figma, Inc. | Data processor (design platform) | United States | | Amazon Web Services | Sub-processor (cloud hosting) | United States / Global | | Figma AI infrastructure | Sub-processor (AI feature processing) | United States | All transfers from the EU/EEA rely on Standard Contractual Clauses. German data protection authorities have accepted SCCs as a valid transfer mechanism, provided supplementary measures are in place — including encryption in transit and at rest, and limiting the categories of data transferred to what is strictly necessary. Figma Enterprise customers can explore data residency commitments directly with Figma’s enterprise sales team. For all other plans, SCCs are the primary legal mechanism for international transfers. ## What German Design Teams Need to Know German companies — particularly product design, UX, and marketing teams — face specific GDPR considerations when using Figma: **Works Council (Betriebsrat) involvement:** Under §87 BetrVG, works councils have co-determination rights over the introduction of technical monitoring systems. Figma generates usage analytics, activity logs, and collaboration data that can track individual designer activity. If Figma is deployed across a team, Betriebsrat consultation may be required before rollout — particularly where usage data could be used in performance assessment. **Design files containing personal data:** This is the compliance issue most commonly overlooked. Figma files regularly contain personal data: - **Photographs** of real people in marketing mockups or product prototypes - **User research data** — screenshots, interview notes, usability test recordings embedded in FigJam - **Customer data** included in UI prototypes (names, email addresses, account numbers in form mockups) Each of these makes Figma a data processor for that content. A signed DPA must be in place before this data enters the platform. **Free plan and Professional plan gap:** Many designers start with Figma’s free Starter plan. There is no DPA for Starter or Professional plan users — these plans are not suitable for any work involving personal data. If employees are using personal Figma accounts for professional work involving client data or user research, this must be addressed in your IT and data protection policy immediately. **Agency and client work:** Design agencies creating files that include client data must treat Figma as a data processor for any personal data in those files. DPA coverage must be in place, and client contracts should address data processing obligations. ## EU AI Act Considerations Figma AI features — layout assistance, content drafting, design generation — are creative assistance tools. Under the EU AI Act, these are generally classified as **limited-risk or minimal-risk AI systems**. They assist human designers rather than making autonomous decisions that significantly affect individuals. No AI Act transparency obligation applies unless Figma AI generates content presented directly to end users who might believe they are interacting with a human. Most internal design workflows do not trigger this obligation. For a broader overview of AI compliance obligations for businesses, see our [AI Act compliance guide](https://compound.law/en-DE/skills/ai-act-compliance/). ## Our Assessment For German product and design teams, **Figma Organization or Enterprise is the minimum plan required** for GDPR-compliant use when design files contain personal data. The DPA is available, Figma does not train on customer content, and sub-processors are documented. The compliance steps are the same as with any US-based SaaS platform: sign the DPA, implement SCCs, review sub-processors, and consult your Betriebsrat if Figma will be used across a team. We do not recommend using Figma’s Starter or Professional plan for any professional work involving personal data — there is no DPA coverage, creating direct exposure under GDPR Article 28. Compound Law can assist with DPA review, SCC implementation, DPIA preparation, and works council negotiations for Figma deployments. *** ## Frequently Asked Questions ### Does Figma have a DPA? Yes. Figma provides a Data Processing Agreement for Organization and Enterprise plan customers. Starter and Professional plan users are not covered by a DPA and cannot lawfully process personal data through Figma in a professional context under GDPR. The DPA must be signed before any design files containing personal data are uploaded. ### Is Figma GDPR compliant for German companies? Figma can be used in a GDPR-compliant way on Organization or Enterprise plans with a signed DPA, Standard Contractual Clauses in place for US data transfers, and updated records of processing activities. Starter and Professional plan users have no DPA coverage and must upgrade before processing personal data. ### Does Figma have an AVV (Auftragsverarbeitungsvertrag)? Yes. Figma’s Data Processing Agreement is the functional equivalent of an Auftragsverarbeitungsvertrag under Article 28 DSGVO. It is available for Organization and Enterprise plan customers and covers Figma’s processing of personal data — including data processed through Figma AI features. ### Does Figma use designs to train AI? Figma states that it does not use customer content — including design files and FigJam content — to train its AI models. This applies to all paid plans. Always verify the current Figma privacy policy and terms of service, as AI training data policies can change. ### Where is Figma data stored? Figma uses Amazon Web Services (AWS) as its primary cloud infrastructure. Data from European customers is processed on AWS, including infrastructure in the United States. Standard Contractual Clauses in Figma’s DPA cover this international transfer. Figma does not offer EU-only data residency as a standard feature outside of Enterprise-level negotiations. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Yes. Figma provides a Data Processing Agreement for Organization and Enterprise plan customers. Starter and Professional plan customers are not covered by a DPA and cannot lawfully process personal data through Figma in a professional context under GDPR. Figma can be used in a GDPR-compliant way on Organization or Enterprise plans with a signed DPA, Standard Contractual Clauses for US data transfers, and updated records of processing activities. Starter and Professional plan users have no DPA coverage. Yes. Figma's Data Processing Agreement is the equivalent of an Auftragsverarbeitungsvertrag under Article 28 DSGVO. It is available for Organization and Enterprise plan customers and must be signed before processing personal data through the platform. Figma states that it does not use customer content — including design files and FigJam content — to train its AI models. This applies to all paid plans. Always verify the current Figma terms of service, as AI training policies can change. Figma uses Amazon Web Services (AWS) as its primary cloud infrastructure. Data from European customers is processed on AWS infrastructure, with Standard Contractual Clauses in place for transfers from the EU/EEA to the United States. Figma does not offer EU-only data residency for standard plans. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Figma DPA: Does Figma Have a Data Processing Agreement for GDPR?", "description": "Figma offers a DPA for Organization and Enterprise plans. Learn what German companies must check before using Figma and Figma AI under GDPR.", "image": "https://compound.law/assets/images/tools/tools_4.webp", "datePublished": "2026-04-07T00:00:00.000Z", "dateModified": "2026-04-07T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/figma-ai/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Figma DPA: Does Figma Have a Data Processing Agreement for GDPR?", "item": "https://compound.law/en-DE/tools/figma-ai/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does Figma have a DPA?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Figma provides a Data Processing Agreement for Organization and Enterprise plan customers. Starter and Professional plan customers are not covered by a DPA and cannot lawfully process personal data through Figma in a professional context under GDPR." } }, { "@type": "Question", "name": "Is Figma GDPR compliant for German companies?", "acceptedAnswer": { "@type": "Answer", "text": "Figma can be used in a GDPR-compliant way on Organization or Enterprise plans with a signed DPA, Standard Contractual Clauses for US data transfers, and updated records of processing activities. Starter and Professional plan users have no DPA coverage." } }, { "@type": "Question", "name": "Does Figma have an AVV (Auftragsverarbeitungsvertrag)?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Figma's Data Processing Agreement is the equivalent of an Auftragsverarbeitungsvertrag under Article 28 DSGVO. It is available for Organization and Enterprise plan customers and must be signed before processing personal data through the platform." } }, { "@type": "Question", "name": "Does Figma use designs to train AI?", "acceptedAnswer": { "@type": "Answer", "text": "Figma states that it does not use customer content — including design files and FigJam content — to train its AI models. This applies to all paid plans. Always verify the current Figma terms of service, as AI training policies can change." } }, { "@type": "Question", "name": "Where is Figma data stored?", "acceptedAnswer": { "@type": "Answer", "text": "Figma uses Amazon Web Services (AWS) as its primary cloud infrastructure. Data from European customers is processed on AWS infrastructure, with Standard Contractual Clauses in place for transfers from the EU/EEA to the United States. Figma does not offer EU-only data residency for standard plans." } } ] } ] ```