--- title: "Hugging Face GDPR & DPA Compliance: What You Need to Know" description: "Is Hugging Face GDPR compliant? Guide to the DPA, EU data residency, Standard Contractual Clauses, and EU AI Act obligations for Germany." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/hugging-face/" language: "en" --- ![Hugging Face GDPR and DPA compliance guide for companies in Germany](https://compound.law/assets/images/tools/tools_4.webp) tools # Hugging Face GDPR & DPA Compliance: What You Need to Know 18 April 2026 **Hugging Face is broadly GDPR compliant as a data processor when companies execute a Data Processing Agreement (DPA), apply Standard Contractual Clauses (SCCs) for US data transfers, and select EU-hosted infrastructure where required.** As an AI platform headquartered in the United States, Hugging Face processes personal data on behalf of business customers and makes a DPA available covering GDPR Article 28 requirements. Whether your specific use is compliant depends on how you configure the service, what data you feed into it, and what obligations you accept as the controller. For German companies, the compliance picture also includes the EU AI Act — particularly the GPAI (General-Purpose AI) provisions — and Works Council obligations under §87 BetrVG where employee data is involved. ## Understanding Hugging Face’s Role Under GDPR Under GDPR, the foundational distinction is between **data controller** and **data processor**. - **You are the controller.** Your company decides what personal data is processed, for what purpose, and on which legal basis. - **Hugging Face is the processor** when you use its hosted Inference API or Hub services to process personal data on your behalf. - **Exception — self-hosted models:** When you download a model from the Hugging Face Hub and run it on your own infrastructure, Hugging Face has no role in the processing — you become the sole controller. This processor/controller split is the foundation of your GDPR compliance analysis. For most enterprise use cases involving the Inference API or Hugging Face Spaces, a DPA must be in place before processing personal data. ## Hugging Face Data Processing Agreement (DPA) Hugging Face provides a DPA for enterprise and pro-tier customers. The DPA covers: - **Processing instructions:** Hugging Face processes data only as directed by you - **Subprocessor list:** Disclosure of downstream processors (compute infrastructure, CDN providers) - **Security measures:** Technical and organizational measures (TOMs) including encryption in transit and at rest - **Data subject rights:** Mechanisms to support your obligations under GDPR Articles 15–22 - **Data breach notification:** Timely notification in line with Article 33 GDPR ### Standard Contractual Clauses (SCCs) for US Data Transfers Hugging Face is a US company. Any transfer of personal data from the EU/EEA to Hugging Face servers in the United States requires a valid transfer mechanism under GDPR Article 46. Hugging Face relies on **EU Standard Contractual Clauses (SCCs)** — the 2021 European Commission module sets — as its primary transfer mechanism. Before transferring data, verify: 1. That the SCCs are incorporated in or annexed to your DPA 2. That you have conducted a **Transfer Impact Assessment (TIA)** where the data is sensitive 3. That US-side legal risks (e.g., FISA Section 702 surveillance) are documented and mitigated where possible ### EU Data Residency Options Hugging Face offers **EU-hosted compute** for inference workloads through its Inference Endpoints product. When you deploy an Inference Endpoint in an EU region (e.g., AWS `eu-west-1`, Azure `westeurope`), inference requests and input data are processed within the EU/EEA. This significantly simplifies GDPR compliance — EU-to-EU data flows do not require SCCs for the inference step. If data residency is a hard requirement (financial services, healthcare, public sector), specify an EU region for all Inference Endpoints and verify that logging and monitoring data also stays within the EU. ## Hugging Face and the EU AI Act The EU AI Act introduces compliance obligations that run alongside GDPR. For Hugging Face, the most relevant provisions are the **GPAI (General-Purpose AI) chapter** (Title VIII) and the **high-risk AI system** rules in Annex III. ### GPAI Model Transparency Obligations Many models on the Hugging Face Hub qualify as General-Purpose AI (GPAI) models under the EU AI Act. Providers of GPAI models must publish: - Technical documentation covering model architecture, training data, and evaluation results - A summary of training data sufficient to identify copyright-relevant sources - Compliance documentation under EU copyright law (Text and Data Mining exception, Article 4 DSM Directive) **Open-weight models trained above 10²⁵ FLOPs** face the most stringent obligations. Hugging Face as the platform provider and GPAI model distributor has separate transparency duties — but your obligations as a **deployer** are distinct and cumulative. ### Your Obligations as a Deployer When you integrate a Hugging Face model into a product or service, you are the **deployer** under the EU AI Act. Your obligations depend on the risk classification of your use case: - **Minimal / limited risk:** Document your AI system, ensure basic transparency where applicable - **High risk (Annex III):** Full conformity assessment, technical documentation, human oversight, post-market monitoring - **Prohibited (Article 5):** Do not deploy — regardless of model availability on the Hub Hugging Face’s GPAI provider obligations and your deployer obligations are separate and both apply. ### GPAI Systemic Risk Models Some frontier models hosted on the Hub (or accessible via API) may be designated **systemic risk GPAI models** if they exceed 10²⁵ FLOPs in training compute. Such models face enhanced obligations including adversarial testing, incident reporting, and cybersecurity measures. Check the EU AI Act Office’s published list for current designations before integrating high-capability frontier models. ## Self-Hosted Models vs. Hugging Face Cloud For compliance-sensitive use cases, **self-hosting a model from the Hugging Face Hub** on your own infrastructure is often the cleanest solution. **Privacy advantages of self-hosting:** - No personal data leaves your infrastructure — no DPA needed with Hugging Face for that processing - Full control over logging, access controls, and audit trails - No dependency on Hugging Face’s uptime or SLAs - Simpler data residency compliance (on-premises in Germany or EU-cloud VM) **Practical requirements:** - GPU compute (on-premises or EU-cloud virtual machine) - Model license compliance — check each model’s license: Apache 2.0, Llama commercial license, CC-BY, etc. - Your own MLOps and inference infrastructure For **air-gapped deployments** (classified data, healthcare, defense), self-hosting is often the only viable path. Download model weights once, verify integrity, and run entirely offline. The [AWS Bedrock GDPR guide](https://compound.law/en-DE/tools/aws-bedrock/) covers a comparable EU-cloud managed inference option if you prefer managed infrastructure over self-hosting. ## High-Risk AI Use Cases on Hugging Face The EU AI Act’s Annex III lists specific **high-risk AI system categories**. If you deploy Hugging Face models for any of these purposes, enhanced compliance obligations apply regardless of the model’s origin: | Use Case | AI Act Classification | Key Obligations | | -------------------------------- | -------------------------- | --------------------------------------------------------------- | | CV screening / candidate ranking | High risk (Annex III, §4) | Conformity assessment, human review, transparency to applicants | | Biometric identification | High risk or prohibited | DPIA, strict legal basis, possible prohibition | | Medical diagnosis support | High risk (Annex III, §5) | Clinical validation, human oversight | | Credit scoring | High risk (Annex III, §5b) | Explainability, audit trail | | Employee performance monitoring | High risk (Annex III, §4) | Works council consultation (§87 BetrVG) | For **HR and recruitment models** specifically, see our [AI employee monitoring compliance guide](https://compound.law/en-DE/compliance/ai-employee-monitoring/) and the detailed guidance on [AI recruitment screening compliance](https://compound.law/en-DE/compliance/ai-recruitment-screening/). ## Practical Compliance Checklist Before deploying Hugging Face in a production environment that processes personal data: - [ ] **DPA executed** with Hugging Face (enterprise tier or equivalent) - [ ] **SCCs in place** for US data transfers, or an EU-hosted Inference Endpoint selected - [ ] **Legal basis identified** under GDPR Article 6 (and Article 9 for special category data) - [ ] **DPIA completed** if processing is likely to result in high risk (GDPR Article 35) - [ ] **Model license reviewed** for commercial use (Apache 2.0, Llama commercial license, etc.) - [ ] **AI Act risk classification documented** for your specific use case and deployment context - [ ] **Works council notified** if deployment affects employees or their work processes (§87 BetrVG) - [ ] **Employee data rules checked** under §26 BDSG if using Hugging Face models in an HR context - [ ] **Deployer obligations met** for high-risk AI systems where applicable - [ ] **Internal AI policy updated** to cover Hugging Face use ## How Compound Law Helps Compound Law advises businesses across Germany and the DACH region on AI procurement, deployment, and ongoing compliance. For Hugging Face specifically, we assist with: - Reviewing and negotiating the Hugging Face DPA - Transfer Impact Assessments for US data flows - EU AI Act risk classification and deployer documentation - Works council consultation strategy and Betriebsvereinbarung drafting - Self-hosting vs. cloud decision analysis for regulated industries For related AI API compliance guides, see our [Anthropic API GDPR compliance guide](https://compound.law/en-DE/tools/anthropic-api/) and [AWS Bedrock GDPR guide](https://compound.law/en-DE/tools/aws-bedrock/). ## Frequently Asked Questions ### Does Hugging Face offer an EU data residency option? Yes. Hugging Face Inference Endpoints can be deployed in EU/EEA regions including AWS `eu-west-1` (Ireland) and Azure `westeurope` (Netherlands). When configured correctly, inference data is processed within the EU and Standard Contractual Clauses are not required for that processing step. However, account management data and platform telemetry may still flow to Hugging Face’s US infrastructure — review the DPA for the full data flow picture. ### Is Hugging Face’s Inference API GDPR compliant? The Inference API can be used in a GDPR-compliant manner when a Data Processing Agreement is in place, Standard Contractual Clauses cover US data transfers, and you have identified an appropriate legal basis for the processing. Hugging Face processes inference requests as your data processor. You remain the controller responsible for the lawfulness of the underlying processing. ### Do I need a DPA with Hugging Face? Yes, if you use Hugging Face’s hosted services — Inference API, Inference Endpoints, or Spaces — to process personal data. GDPR Article 28 requires a written DPA between controller and processor. If you only download model weights and run them on your own infrastructure, Hugging Face is not involved in the data processing and no DPA is required for that activity. ### What EU AI Act obligations apply to models from Hugging Face? Your obligations as a **deployer** depend on the risk classification of your use case, not the model’s origin. Low-risk uses such as text summarization or code generation require minimal compliance steps. High-risk uses — CV screening, medical diagnosis support, credit scoring — require conformity assessment, human oversight, and technical documentation. Prohibited uses under Article 5 (social scoring, certain biometric systems) are not permitted regardless of model availability on the Hub. ### Is using Hugging Face open-source models self-hosted GDPR compliant? Generally yes. When you self-host a Hugging Face model on your own servers in Germany or the EU, personal data does not leave your infrastructure. There is no data transfer to Hugging Face, so GDPR international transfer rules do not apply. You are the sole data controller. Compliance then depends on your own security measures, data minimization practices, and legal basis for processing — not on Hugging Face’s infrastructure or privacy practices. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Yes. Hugging Face Inference Endpoints can be deployed in EU/EEA regions including AWS \`eu-west-1\` (Ireland) and Azure \`westeurope\` (Netherlands). When configured correctly, inference data is processed within the EU and Standard Contractual Clauses are not required for that processing step. However, account management data and platform telemetry may still flow to Hugging Face's US infrastructure — review the DPA for the full data flow picture. The Inference API can be used in a GDPR-compliant manner when a Data Processing Agreement is in place, Standard Contractual Clauses cover US data transfers, and you have identified an appropriate legal basis for the processing. Hugging Face processes inference requests as your data processor. You remain the controller responsible for the lawfulness of the underlying processing. Yes, if you use Hugging Face's hosted services — Inference API, Inference Endpoints, or Spaces — to process personal data. GDPR Article 28 requires a written DPA between controller and processor. If you only download model weights and run them on your own infrastructure, Hugging Face is not involved in the data processing and no DPA is required for that activity. Your obligations as a \*\*deployer\*\* depend on the risk classification of your use case, not the model's origin. Low-risk uses such as text summarization or code generation require minimal compliance steps. High-risk uses — CV screening, medical diagnosis support, credit scoring — require conformity assessment, human oversight, and technical documentation. Prohibited uses under Article 5 (social scoring, certain biometric systems) are not permitted regardless of model availability on the Hub. Generally yes. When you self-host a Hugging Face model on your own servers in Germany or the EU, personal data does not leave your infrastructure. There is no data transfer to Hugging Face, so GDPR international transfer rules do not apply. You are the sole data controller. Compliance then depends on your own security measures, data minimization practices, and legal basis for processing — not on Hugging Face's infrastructure or privacy practices. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Hugging Face GDPR & DPA Compliance: What You Need to Know", "description": "Is Hugging Face GDPR compliant? Guide to the DPA, EU data residency, Standard Contractual Clauses, and EU AI Act obligations for Germany.", "image": "https://compound.law/assets/images/tools/tools_4.webp", "datePublished": "2026-04-18T00:00:00.000Z", "dateModified": "2026-04-18T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/hugging-face/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Hugging Face GDPR & DPA Compliance: What You Need to Know", "item": "https://compound.law/en-DE/tools/hugging-face/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does Hugging Face offer an EU data residency option?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Hugging Face Inference Endpoints can be deployed in EU/EEA regions including AWS `eu-west-1` (Ireland) and Azure `westeurope` (Netherlands). When configured correctly, inference data is processed within the EU and Standard Contractual Clauses are not required for that processing step. However, account management data and platform telemetry may still flow to Hugging Face's US infrastructure — review the DPA for the full data flow picture." } }, { "@type": "Question", "name": "Is Hugging Face's Inference API GDPR compliant?", "acceptedAnswer": { "@type": "Answer", "text": "The Inference API can be used in a GDPR-compliant manner when a Data Processing Agreement is in place, Standard Contractual Clauses cover US data transfers, and you have identified an appropriate legal basis for the processing. Hugging Face processes inference requests as your data processor. You remain the controller responsible for the lawfulness of the underlying processing." } }, { "@type": "Question", "name": "Do I need a DPA with Hugging Face?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, if you use Hugging Face's hosted services — Inference API, Inference Endpoints, or Spaces — to process personal data. GDPR Article 28 requires a written DPA between controller and processor. If you only download model weights and run them on your own infrastructure, Hugging Face is not involved in the data processing and no DPA is required for that activity." } }, { "@type": "Question", "name": "What EU AI Act obligations apply to models from Hugging Face?", "acceptedAnswer": { "@type": "Answer", "text": "Your obligations as a **deployer** depend on the risk classification of your use case, not the model's origin. Low-risk uses such as text summarization or code generation require minimal compliance steps. High-risk uses — CV screening, medical diagnosis support, credit scoring — require conformity assessment, human oversight, and technical documentation. Prohibited uses under Article 5 (social scoring, certain biometric systems) are not permitted regardless of model availability on the Hub." } }, { "@type": "Question", "name": "Is using Hugging Face open-source models self-hosted GDPR compliant?", "acceptedAnswer": { "@type": "Answer", "text": "Generally yes. When you self-host a Hugging Face model on your own servers in Germany or the EU, personal data does not leave your infrastructure. There is no data transfer to Hugging Face, so GDPR international transfer rules do not apply. You are the sole data controller. Compliance then depends on your own security measures, data minimization practices, and legal basis for processing — not on Hugging Face's infrastructure or privacy practices." } } ] } ] ```