--- title: "Miro GDPR Compliance: DPA for German Companies" description: "Is Miro GDPR compliant? How to review the Miro DPA, manage data transfers, and use Miro lawfully in Germany." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/miro/" language: "en" --- ![Miro GDPR and DPA compliance for German companies](https://compound.law/assets/images/tools/tools_2.webp) tools # Miro GDPR Compliance: DPA for German Companies 7 April 2026 Short answer Miro offers a GDPR-compatible Data Processing Agreement and is used by many German companies, but compliance depends on your rollout — specifically the DPA review, transfer mechanism, AI feature settings, and works council assessment. - Miro provides a DPA under GDPR Article 28 — review subprocessors and transfer terms before rollout. - Miro AI features offer an opt-out from model training — verify settings in your enterprise account. - German companies should assess Standard Contractual Clauses and BetrVG co-determination before deployment. **Yes, Miro offers a Data Processing Agreement (DPA) and can be used in a GDPR-compliant way in Germany — but compliance is not automatic.** The legal result depends on whether your company has reviewed the Miro DPA, assessed the transfer mechanism for EU-to-US data flows, configured AI feature settings, and considered works council requirements under German law. For most German companies, the core question is not whether Miro is “allowed,” but whether your specific rollout is structured correctly. Miro is widely used by German product, design, and strategy teams. Its collaborative whiteboard environment means boards can accumulate a wide range of business content — from strategic planning to customer research, workshop outputs, and employee-related material. That breadth makes the GDPR review more important than it might appear at first glance. ## Is Miro GDPR Compliant? Miro is GDPR-ready in the sense that it provides relevant contractual documentation and has implemented technical measures for EU customers. But readiness at the vendor level is not the same as compliance at the customer level. German companies can lawfully use Miro if they: 1. sign and review the **Miro Data Processing Agreement** (DPA), 2. identify the categories of personal data that will appear in boards, 3. assess the transfer mechanism for processing outside the EU, 4. define which use cases are approved or restricted within the organization, 5. configure AI feature settings appropriately, and 6. document the rollout as part of the company’s AI and vendor governance process. The relevant legal framework includes **Article 28 GDPR** (processor obligations), **Articles 5 and 32 GDPR** (data minimization and security), **Chapter V GDPR** (international transfers), and — depending on how Miro is deployed within teams — **Section 87(1) no. 6 BetrVG** (works council co-determination). If you are running a broader AI tool procurement process, our pages on [Notion DPA and GDPR](https://compound.law/en-DE/tools/notion-ai/), [Figma AI](https://compound.law/en-DE/tools/figma-ai/), and [Canva AI](https://compound.law/en-DE/tools/canva-ai/) cover how similar collaboration tools handle these questions. ## Miro Data Processing Agreement (DPA) Miro provides a DPA that documents its role as a data processor under GDPR Article 28. The DPA covers the legal basis for processing, subprocessor disclosure, and deletion commitments. When reviewing the Miro DPA, legal and privacy teams should check: - whether the **correct Miro entity** is named and whether it matches the commercial contract, - which **subprocessors** are listed and how changes are notified, - what the **transfer mechanism** is for EU-to-US data flows — Standard Contractual Clauses (SCCs) are the standard path, - how **deletion, return, and retention** are addressed after contract termination, - and whether the DPA covers the specific Miro features the company intends to use, including AI-assisted features. Enterprise customers typically access the DPA through Miro’s legal and privacy portal. The agreement can in most cases be signed online without requiring a separately negotiated addendum, which simplifies the procurement process for most German companies. That said, the existence of a DPA does not resolve every compliance question. The harder issue is whether your actual board usage stays within the boundaries of what the DPA and your internal policies permit. ## Miro AI Features and GDPR Miro’s AI features — including AI-assisted diagramming, sticky note summarization, and generative content tools — introduce additional GDPR considerations beyond the core platform. The key questions for German legal and privacy teams are: - **Model training:** Does Miro use board content to train AI models? Miro’s enterprise terms have included opt-out mechanisms for content not being used for AI model training. Verify the current scope of that opt-out in your contract and settings before enabling AI features. - **Data processing location:** Where are AI prompts and outputs processed? AI inference may involve additional infrastructure not covered under standard data residency commitments. - **Purpose limitation:** If employees use Miro AI on boards containing customer data, personal data, or confidential business information, that processing must fit within an established legal basis. - **Transparency:** If Miro AI interacts with customers or third parties in a way that might not be obvious, disclosure obligations under GDPR and potentially the EU AI Act may apply. For most internal productivity uses — brainstorming, planning, workshop facilitation — Miro AI can be deployed with appropriate opt-out settings and a clear internal policy on what may be entered into AI-enabled boards. ## Miro and German Data Protection Requirements Beyond the GDPR baseline, German companies face specific requirements that affect how Miro should be deployed. **Standard Contractual Clauses (SCCs) and transfer impact assessment.** Because Miro routes data to the United States under its standard configuration, SCCs are the primary transfer mechanism for EU customers. German data protection authorities have applied strict standards to SCCs since the *Schrems II* judgment. A transfer impact assessment is recommended — and may be required — before rolling out Miro for workflows involving significant personal data. **Bundesdatenschutzgesetz (BDSG).** The German Federal Data Protection Act supplements GDPR with additional requirements, particularly around employee data. If Miro boards contain employee-related information — performance notes, organizational charts with personal context, HR workshop outputs — the BDSG’s stricter employee data protections apply. **Works council co-determination (BetrVG).** Under Section 87(1) no. 6 of the Betriebsverfassungsgesetz, works councils have co-determination rights over the introduction and use of technical monitoring systems. Miro is not primarily a monitoring tool, but its deployment can still trigger this right if it changes how work is organized or creates the potential for employee activity tracking. Companies should assess whether works council consultation is needed before rollout — especially for broader enterprise deployments. Engaging the works council early with a clear description of the tool, the data it touches, and the planned controls is almost always faster than addressing a late objection. ## How to Use Miro Compliantly in Germany The most defensible Miro rollout starts with governance before enablement — not the reverse. **Practical settings and controls:** - Enable the AI opt-out for model training in Miro enterprise account settings. - Review and configure board-level sharing settings, external access, and guest permissions. - Restrict which boards or teams can use Miro AI features on day one. - Define prohibited content categories — for example, employee performance data, customer personal data, or confidential legal material — that should not appear on AI-enabled boards. - Set up internal training on acceptable Miro use and prompt hygiene. - Integrate Miro into your vendor management and data processing register. **Typical risk levels by use case:** | Use case | Data typically involved | Risk level | What to review | | ---------------------------------------- | ------------------------------------ | -------------- | --------------------------------------- | | Product roadmap and planning boards | Internal strategy, low personal data | Low | DPA, access permissions | | Workshop facilitation (internal teams) | General business content | Low | Board sharing settings | | Customer journey mapping or UX research | Customer names, behavioral data | Medium | Legal basis, data minimization | | HR and organizational design work | Employee personal data, roles | High | BDSG, works council, narrow permissions | | AI summarization on mixed-content boards | Varied — depends on board content | Medium to high | AI opt-out, data category review | For the highest-risk use cases involving employee or customer personal data, consider whether a Data Protection Impact Assessment (DPIA) is required under GDPR Article 35. ## How Compound Law Helps Compound Law supports German and DACH companies with Miro DPA review, GDPR transfer assessments, works council strategy, and AI governance documentation for legal, privacy, IT, and operations teams. Typical support includes: - Miro DPA review and gap analysis, - Standard Contractual Clauses and transfer impact assessment, - GDPR use-case mapping for employee and customer data, - internal AI and vendor governance policies, - works council consultation strategy and documentation, - and rollout guidance aligned with BDSG and BetrVG requirements. Specific compliance situations require individual legal advice. This guide structures the review but does not replace a fact-specific assessment of your company’s data flows, contracts, and board content. ## FAQ ### Is Miro GDPR compliant? Miro provides GDPR-compatible contractual documentation including a Data Processing Agreement. Your company’s compliance depends on the DPA review, the transfer mechanism for US data flows, the categories of personal data in your boards, and your internal controls. Compliance is not automatic and must be actively managed. ### Does Miro offer a Data Processing Agreement (DPA)? Yes. Miro provides a DPA covering Article 28 GDPR processor requirements. Enterprise customers can typically access and sign it online. Legal teams should review the subprocessor list, transfer terms, deletion commitments, and whether the DPA covers the Miro AI features in scope for the rollout. ### Where does Miro store data? Miro’s standard infrastructure routes data through the United States. EU enterprise plans may offer data residency options, but the default relies on Standard Contractual Clauses as the EU-to-US transfer mechanism. A transfer impact assessment is advisable before significant personal data is processed through Miro. ### Can German companies use Miro AI features under GDPR? Yes, with appropriate controls. Enterprise customers can opt out of board content being used for AI model training. Internal policies should define which board content may be processed by AI features, and the AI opt-out setting should be verified before enabling AI tools for teams that work with personal or confidential data. ### Do German companies need works council approval for Miro? It depends on the rollout scope and how Miro will be used. If the deployment affects work organization or could create the impression of monitoring employee activity, Section 87(1) no. 6 BetrVG may give the works council co-determination rights. Early consultation avoids delays and reduces legal risk. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Miro offers GDPR-compatible contractual terms and a Data Processing Agreement, but your company's compliance depends on your specific use case, data categories, access permissions, and transfer setup. Signing up does not make the rollout automatically compliant. Yes. Miro provides a DPA covering Article 28 GDPR processor requirements. Enterprise customers can access and sign it through Miro's legal and privacy documentation. Review the subprocessor list and transfer mechanisms as part of your procurement check. Miro primarily processes data in the United States. Enterprise plans may include data residency options for the EU, but the standard configuration relies on Standard Contractual Clauses as the transfer mechanism for EU-to-US data flows. Yes, with appropriate controls in place. Miro allows enterprise customers to opt out of using board content for AI model training. Verify the current opt-out scope in your contract and confirm it covers all Miro AI features your team intends to use. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Miro GDPR Compliance: DPA for German Companies", "description": "Is Miro GDPR compliant? How to review the Miro DPA, manage data transfers, and use Miro lawfully in Germany.", "image": "https://compound.law/assets/images/tools/tools_2.webp", "datePublished": "2026-04-07T00:00:00.000Z", "dateModified": "2026-04-07T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/miro/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Miro GDPR Compliance: DPA for German Companies", "item": "https://compound.law/en-DE/tools/miro/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is Miro GDPR compliant?", "acceptedAnswer": { "@type": "Answer", "text": "Miro offers GDPR-compatible contractual terms and a Data Processing Agreement, but your company's compliance depends on your specific use case, data categories, access permissions, and transfer setup. Signing up does not make the rollout automatically compliant." } }, { "@type": "Question", "name": "Does Miro offer a Data Processing Agreement (DPA)?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Miro provides a DPA covering Article 28 GDPR processor requirements. Enterprise customers can access and sign it through Miro's legal and privacy documentation. Review the subprocessor list and transfer mechanisms as part of your procurement check." } }, { "@type": "Question", "name": "Where does Miro store data?", "acceptedAnswer": { "@type": "Answer", "text": "Miro primarily processes data in the United States. Enterprise plans may include data residency options for the EU, but the standard configuration relies on Standard Contractual Clauses as the transfer mechanism for EU-to-US data flows." } }, { "@type": "Question", "name": "Can German companies use Miro AI features under GDPR?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, with appropriate controls in place. Miro allows enterprise customers to opt out of using board content for AI model training. Verify the current opt-out scope in your contract and confirm it covers all Miro AI features your team intends to use." } } ] } ] ```