--- title: "Grammarly GDPR Compliance in Germany: DPA, AVV, and Data Privacy" description: "Grammarly offers a DPA for Enterprise customers. Learn what German businesses must assess before deploying Grammarly under GDPR and DSGVO." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/grammarly/" language: "en" --- ![Grammarly GDPR compliance and data processing agreement for German businesses](https://compound.law/assets/images/tools/tools_2.webp) tools # Grammarly GDPR Compliance in Germany: DPA, AVV, and Data Privacy 6 April 2026 **Grammarly offers a Data Processing Agreement (DPA) for Enterprise customers.** German businesses using Grammarly must assess what employee text data Grammarly processes, confirm the DPA is in place as the Auftragsverarbeitungsvertrag (AVV) required under Article 28 DSGVO, and evaluate whether the Betriebsrat must be involved before deployment. Because Grammarly analyzes employee-written text — including emails, contracts, and internal documents — it raises specific **Beschäftigtendatenschutz** (employee data protection) concerns under German law. ## Does Grammarly Have a Data Processing Agreement (DPA)? Grammarly provides a Data Processing Agreement, but availability depends on your subscription plan: - **Grammarly Enterprise:** Full DPA available, covering sub-processors, data deletion timelines, and Standard Contractual Clauses for EU-US transfers. - **Grammarly Business:** DPA available on request through the account management process. - **Grammarly Free and Premium:** No DPA available. These plans are **not suitable for processing personal data of employees or customers** under GDPR. This plan-tier restriction makes Grammarly fundamentally different from tools like HubSpot or Zendesk, which offer DPAs to all paying customers. German companies that deploy Grammarly on Free or Premium plans for employee use are likely in breach of Article 28 DSGVO. The Grammarly DPA covers: - **Processing scope:** Categories of personal data processed (text written by employees, metadata about corrections and suggestions) - **Sub-processor obligations:** Third parties Grammarly uses to deliver the service, including cloud infrastructure providers - **EU data transfer mechanisms:** Standard Contractual Clauses (SCCs) for transfers of personal data from the EU/EEA to Grammarly’s US infrastructure - **Data retention:** How long Grammarly retains text snippets and user data - **Security measures:** Technical and organizational measures Grammarly maintains ## Grammarly AVV for German Businesses (Auftragsverarbeitungsvertrag) Under German law, the Data Processing Agreement functions as the **Auftragsverarbeitungsvertrag (AVV)** required by Article 28 DSGVO whenever a controller engages a processor to handle personal data on its behalf. Steps for German companies deploying Grammarly Enterprise or Business: 1. **Confirm plan eligibility:** Verify that your Grammarly subscription includes DPA access before deployment. 2. **Execute the DPA/AVV:** Request and sign the DPA through your Grammarly account manager or the customer portal. 3. **Document in your records of processing:** Add Grammarly to your Verzeichnis von Verarbeitungstätigkeiten (Article 30 DSGVO processing register) as a processor for employee communication data. 4. **Review Standard Contractual Clauses:** Verify that the EU SCCs (Commission Decision 2021/914) are incorporated into the DPA for the EU-US data transfer. 5. **Check the sub-processor list:** Review Grammarly’s published sub-processor list and update your employee-facing privacy notices accordingly. Deploying Grammarly without a valid DPA while employees process personal data through the tool constitutes a GDPR violation and exposes the company to supervisory authority fines. ## What Data Does Grammarly Collect From Employees? This is the central GDPR question for Grammarly deployments. Grammarly’s browser extension and desktop app analyze text as it is being written — in real time. Depending on your configuration and plan, Grammarly may process: - **Email content:** Text written in Gmail, Outlook, and other email clients - **Document content:** Text written in Google Docs, Microsoft Word, and other editors - **Internal messaging:** Text composed in Slack, Teams, and similar platforms - **Confidential business content:** Contract drafts, proposals, HR correspondence, and legal documents For German businesses, this creates two distinct GDPR concerns: - **Employee personal data:** Grammarly processes data attributable to employees in the course of their work. The legal basis for this processing must be established (typically Art. 6(1)(b) DSGVO — performance of employment contract — or a legitimate interest assessment). - **Third-party personal data:** Employees may write about or to third parties (clients, candidates, patients), making Grammarly a processor of that third-party personal data too. Grammarly allows administrators to configure **snippet storage settings** — reducing the amount of text that Grammarly retains on its servers. For sensitive industries (legal, medical, financial), disabling text storage is strongly recommended and should be documented as a technical measure in your DPIA. ## Is Grammarly GDPR Compliant? EU Data Residency and Subprocessors Grammarly’s infrastructure is primarily hosted in the United States. Unlike some enterprise software vendors, Grammarly does not currently offer an EU data residency option that routes all processing to EU-based servers. Key facts on data transfers: - **Standard Contractual Clauses:** Required for any EU-US data transfer. Grammarly incorporates SCCs into its Enterprise DPA as the transfer mechanism under Chapter V GDPR. - **No EU data center option:** As of 2026, Grammarly does not offer the ability to elect EU-only processing. All user text passes through US-based infrastructure. - **Sub-processors:** Grammarly uses third-party cloud infrastructure providers (including AWS and Google Cloud). The sub-processor list is available to Enterprise customers and should be reviewed against your data transfer impact assessment requirements. For German companies with strict data localization requirements — common in healthcare, banking, and public sector procurement — the absence of an EU data residency option is a significant factor in the procurement decision. Conduct a Transfer Impact Assessment (TIA) as part of your DPIA if deploying in these sectors. ## Grammarly Enterprise vs. Business — GDPR Compliance Differences | Feature | Grammarly Enterprise | Grammarly Business | Free/Premium | | ---------------------------------- | -------------------- | ------------------ | ------------ | | DPA/AVV available | Yes | On request | No | | Custom data retention | Yes | Limited | No | | Admin controls (snippet storage) | Yes | Partial | No | | SSO/centralized provisioning | Yes | Yes | No | | Sub-processor list access | Yes | On request | No | | GDPR-ready for employee deployment | Yes (with DPA) | With DPA + review | No | For German enterprises with more than 20 employees, Grammarly Enterprise is the only plan tier that provides the full set of controls needed for GDPR-compliant deployment. ## Works Council (Betriebsrat) Requirements for Grammarly Grammarly raises specific co-determination issues under German labor law. The Betriebsrat has mandatory participation rights under **§87(1) No. 6 BetrVG** for technical systems capable of monitoring employee behavior or performance. Grammarly qualifies as such a system because it: - Analyzes every word employees write in real time - Generates correction statistics and writing quality metrics per user - Maintains logs of writing activity across integrated applications - Can reveal patterns in an employee’s communication style, responsiveness, and writing volume Before deploying Grammarly in any organization with a works council, you must: 1. **Inform the Betriebsrat** about the planned introduction of Grammarly, including which features will be activated and which data Grammarly collects 2. **Negotiate a Betriebsvereinbarung** (works agreement) defining permissible use cases, the scope of data collection, and any restrictions on admin access to per-user writing statistics 3. **Document the agreement** before going live — deploying Grammarly without works council involvement can result in an injunction against the system’s use The works agreement should specifically address whether administrators will have access to individual-level writing statistics or only aggregate team data, as this determines the monitoring risk under BetrVG. ## Compliance Checklist for German Companies Deploying Grammarly Use this checklist before going live with Grammarly in a German business context: - [ ] **Plan eligibility confirmed:** Enterprise or Business plan with DPA access verified - [ ] **DPA/AVV signed:** Grammarly DPA executed with your account manager - [ ] **SCCs confirmed:** Standard Contractual Clauses incorporated into the DPA for EU-US transfers - [ ] **Sub-processor list reviewed:** Current list reviewed, privacy notices updated - [ ] **Records of processing updated:** Grammarly added to Article 30 DSGVO processing register - [ ] **Employee privacy notice updated:** Grammarly’s data processing disclosed in employee-facing privacy notices - [ ] **Snippet storage configured:** Text retention disabled or minimized in Grammarly admin settings - [ ] **DPIA conducted:** Required for large-scale processing of employee text data — document transfer risks and mitigations - [ ] **Transfer Impact Assessment:** Completed for EU-US text data transfers given absence of EU data residency - [ ] **Betriebsrat informed:** Works council notified before deployment - [ ] **Betriebsvereinbarung concluded:** Works agreement governing permissible use and data access signed Compound Law assists with DPA review, SCC gap analysis, DPIA preparation, Transfer Impact Assessments, and Betriebsrat negotiations for Grammarly deployments across Germany and the DACH region. See our [compliance services](https://compound.law/en-DE/compliance/) for details. Compare Grammarly with [Cursor](https://compound.law/en-DE/tools/cursor/) and [Copilot for Microsoft 365](https://compound.law/en-DE/tools/copilot-microsoft-365/), both of which process employee-authored code or text and raise comparable Betriebsrat and GDPR considerations. *** ## Frequently Asked Questions ### Is Grammarly GDPR compliant in Germany? Grammarly can be used in a GDPR-compliant manner, but only under Grammarly Enterprise or Business plans where a DPA is available. Free and Premium plans lack a DPA and are not suitable for processing employee or customer personal data. Compliance also requires Standard Contractual Clauses for EU-US data transfers, updated records of processing, and — in organizations with a works council — a Betriebsvereinbarung before deployment. ### Does Grammarly have an AVV (Auftragsverarbeitungsvertrag)? Yes, but only for Enterprise customers (and on request for Business customers). Grammarly’s Data Processing Agreement functions as the AVV required under Article 28 DSGVO. Free and Premium plans do not include a DPA. If your organization uses Grammarly without an Enterprise or Business subscription, you cannot lawfully process employee personal data through the tool. ### Can I use Grammarly for confidential legal documents? Use caution. Grammarly analyzes text as you write it, which means confidential content — including legal documents, HR correspondence, and contracts — passes through Grammarly’s servers. In Enterprise plans, snippet storage can be disabled to reduce retention risk. For highly sensitive content, legal and compliance teams should configure Grammarly to minimize storage or exclude specific applications from the browser extension’s scope. ### Does Grammarly store my employees’ text? By default, Grammarly stores text snippets to improve its suggestions. Under Grammarly Enterprise, administrators can configure reduced or disabled snippet storage. This setting should be reviewed and documented as part of your data minimization obligations under Article 5(1)(c) DSGVO. Check your current plan’s admin settings and confirm the storage configuration with your account manager. ### Do I need a Betriebsrat agreement to use Grammarly? If your organization has a works council (Betriebsrat) and Grammarly will be deployed for employees, co-determination rights under §87(1) No. 6 BetrVG are almost certainly triggered. Grammarly monitors employee writing activity in real time, which qualifies as a technical monitoring system under German labor law. A Betriebsvereinbarung must be negotiated and signed before the tool goes live. Deploying without works council involvement risks an injunction against the system’s use. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Grammarly can be used in a GDPR-compliant manner, but only under Grammarly Enterprise or Business plans where a DPA is available. Free and Premium plans lack a DPA and are not suitable for processing employee or customer personal data. Compliance also requires Standard Contractual Clauses for EU-US data transfers, updated records of processing, and — in organizations with a works council — a Betriebsvereinbarung before deployment. Yes, but only for Enterprise customers (and on request for Business customers). Grammarly's Data Processing Agreement functions as the AVV required under Article 28 DSGVO. Free and Premium plans do not include a DPA. If your organization uses Grammarly without an Enterprise or Business subscription, you cannot lawfully process employee personal data through the tool. Use caution. Grammarly analyzes text as you write it, which means confidential content — including legal documents, HR correspondence, and contracts — passes through Grammarly's servers. In Enterprise plans, snippet storage can be disabled to reduce retention risk. For highly sensitive content, legal and compliance teams should configure Grammarly to minimize storage or exclude specific applications from the browser extension's scope. By default, Grammarly stores text snippets to improve its suggestions. Under Grammarly Enterprise, administrators can configure reduced or disabled snippet storage. This setting should be reviewed and documented as part of your data minimization obligations under Article 5(1)(c) DSGVO. Check your current plan's admin settings and confirm the storage configuration with your account manager. If your organization has a works council (Betriebsrat) and Grammarly will be deployed for employees, co-determination rights under §87(1) No. 6 BetrVG are almost certainly triggered. Grammarly monitors employee writing activity in real time, which qualifies as a technical monitoring system under German labor law. A Betriebsvereinbarung must be negotiated and signed before the tool goes live. Deploying without works council involvement risks an injunction against the system's use. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Grammarly GDPR Compliance in Germany: DPA, AVV, and Data Privacy", "description": "Grammarly offers a DPA for Enterprise customers. Learn what German businesses must assess before deploying Grammarly under GDPR and DSGVO.", "image": "https://compound.law/assets/images/tools/tools_2.webp", "datePublished": "2026-04-06T00:00:00.000Z", "dateModified": "2026-04-06T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/grammarly/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Grammarly GDPR Compliance in Germany: DPA, AVV, and Data Privacy", "item": "https://compound.law/en-DE/tools/grammarly/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is Grammarly GDPR compliant in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "Grammarly can be used in a GDPR-compliant manner, but only under Grammarly Enterprise or Business plans where a DPA is available. Free and Premium plans lack a DPA and are not suitable for processing employee or customer personal data. Compliance also requires Standard Contractual Clauses for EU-US data transfers, updated records of processing, and — in organizations with a works council — a Betriebsvereinbarung before deployment." } }, { "@type": "Question", "name": "Does Grammarly have an AVV (Auftragsverarbeitungsvertrag)?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, but only for Enterprise customers (and on request for Business customers). Grammarly's Data Processing Agreement functions as the AVV required under Article 28 DSGVO. Free and Premium plans do not include a DPA. If your organization uses Grammarly without an Enterprise or Business subscription, you cannot lawfully process employee personal data through the tool." } }, { "@type": "Question", "name": "Can I use Grammarly for confidential legal documents?", "acceptedAnswer": { "@type": "Answer", "text": "Use caution. Grammarly analyzes text as you write it, which means confidential content — including legal documents, HR correspondence, and contracts — passes through Grammarly's servers. In Enterprise plans, snippet storage can be disabled to reduce retention risk. For highly sensitive content, legal and compliance teams should configure Grammarly to minimize storage or exclude specific applications from the browser extension's scope." } }, { "@type": "Question", "name": "Does Grammarly store my employees' text?", "acceptedAnswer": { "@type": "Answer", "text": "By default, Grammarly stores text snippets to improve its suggestions. Under Grammarly Enterprise, administrators can configure reduced or disabled snippet storage. This setting should be reviewed and documented as part of your data minimization obligations under Article 5(1)(c) DSGVO. Check your current plan's admin settings and confirm the storage configuration with your account manager." } }, { "@type": "Question", "name": "Do I need a Betriebsrat agreement to use Grammarly?", "acceptedAnswer": { "@type": "Answer", "text": "If your organization has a works council (Betriebsrat) and Grammarly will be deployed for employees, co-determination rights under §87(1) No. 6 BetrVG are almost certainly triggered. Grammarly monitors employee writing activity in real time, which qualifies as a technical monitoring system under German labor law. A Betriebsvereinbarung must be negotiated and signed before the tool goes live. Deploying without works council involvement risks an injunction against the system's use." } } ] } ] ```