--- title: "Is Perplexity AI GDPR Compliant? Yes — on Enterprise, With a DPA" description: "Yes — but only on the Enterprise plan with a signed DPA. Free and Pro plans have no DPA, and US storage makes SCCs mandatory for German businesses." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/perplexity/" language: "en" --- ![Perplexity AI GDPR compliance and data processing agreement for EU businesses](https://compound.law/assets/images/tools/tools_4.webp) tools # Is Perplexity AI GDPR Compliant? Yes — on Enterprise, With a DPA 16 April 2026 **Yes — Perplexity AI can be GDPR-compliant, but only on the Enterprise plan with a signed Data Processing Agreement (DPA); free and standard Pro accounts have no DPA and are not suitable for processing personal data.** Perplexity is a US-based service: data is stored in the United States by default, and international transfers rely on Standard Contractual Clauses (SCCs). German companies can therefore deploy Perplexity GDPR-compliantly only with the Enterprise plan, a signed DPA functioning as the Auftragsverarbeitungsvertrag (AVV) under Article 28 DSGVO, confirmed SCCs, and a documented legal basis under Article 6(1) DSGVO. ## Is Perplexity AI GDPR Compliant? Perplexity AI can be used in a GDPR-compliant manner, but only under specific conditions. As a US-based AI service, Perplexity stores and processes data on US servers. For EU businesses, this creates data transfer obligations under GDPR Article 46. The critical requirements for GDPR-compliant Perplexity use are: - **Enterprise plan required:** Only the Perplexity Enterprise plan includes a Data Processing Agreement (DPA), which functions as an Auftragsverarbeitungsvertrag (AVV) under Article 28 DSGVO - **SCCs required:** International data transfers from the EU to Perplexity’s US infrastructure must be covered by Standard Contractual Clauses (Module 2) - **No DPA for free or Pro users:** Standard terms allow Perplexity to use query data for model improvement, making those plans unsuitable for business queries involving personal data German companies can deploy Perplexity GDPR-compliantly — but only with the Enterprise plan, a signed DPA, confirmed SCCs, and a documented legal basis under Article 6(1) DSGVO. ## What Is Perplexity AI? **Perplexity AI** is an AI-powered search and research tool that provides answers to queries by combining large language models with real-time web retrieval. Businesses use it for research, competitive intelligence, legal background work, and general productivity. Perplexity offers consumer plans (free, Pro) and an enterprise plan (**Perplexity Enterprise Pro**) with enhanced data privacy controls. Unlike a standard search engine, Perplexity processes natural-language queries, generates synthesized responses, and may retain query content depending on account type and settings — which creates GDPR considerations that a traditional keyword search engine does not. ## What Data Does Perplexity Process? Perplexity collects and processes: - **Search queries:** The full text of every query entered — the primary personal data risk for business users - **Uploaded files:** Documents, PDFs, or images submitted as part of queries - **Account data:** Email addresses, usage history, and settings for registered users - **Usage metadata:** Device information, IP addresses, and session data ### Enterprise vs. Consumer Data Handling The GDPR-relevant distinction is between Perplexity’s consumer and enterprise tiers: | Data Type | Free / Pro | Enterprise | | -------------------------------- | --------------- | ----------------------------- | | Queries used for model training | Potentially yes | No (contractually prohibited) | | Queries retained long-term | Yes | Configurable | | DPA / AVV available | No | Yes | | EU-US SCC mechanism | Not provided | Included (Module 2) | | Sub-processor disclosure | Limited | Full list | | GDPR-compliant for personal data | No | Yes (with proper setup) | | SSO / access management | No | Yes | ## Perplexity’s Data Processing Agreement (DPA) ### Does Perplexity Offer a DPA for EU Companies? Yes — Perplexity provides a **Data Processing Agreement for Enterprise customers only**. The DPA designates Perplexity as a data processor under Article 28 GDPR, with your organization as the data controller. Key provisions of the Perplexity Enterprise DPA: - **No training on Enterprise data:** Query data and outputs are not used to train or improve Perplexity’s AI models — a contractually guaranteed difference from consumer plans - **Processor designation:** Perplexity acts strictly as your processor for Enterprise-plan queries and outputs - **Data retention limits:** Enterprise agreements specify retention periods and deletion procedures - **Sub-processor disclosure:** Perplexity discloses all infrastructure and processing sub-processors to Enterprise customers **For free and Pro users:** Without a DPA, Perplexity’s standard terms permit use of data to improve services. Processing personal data through these plans — even incidentally — constitutes a GDPR violation for German businesses. ### Standard Contractual Clauses for EU Transfers The Perplexity Enterprise DPA includes **Standard Contractual Clauses (SCCs)** under Article 46 GDPR, specifically **Module 2 (Controller to Processor)**. This is the legal mechanism permitting EU personal data to be processed on Perplexity’s US infrastructure following the Schrems II ruling, which invalidated the EU-US Privacy Shield. For formal GDPR compliance, German businesses should also conduct a **Transfer Impact Assessment (TIA)** to evaluate whether US intelligence surveillance laws — particularly FISA 702 and Executive Order 12333 — present specific risks to the data transferred, and whether the SCCs provide sufficient protection in practice. ## Data Storage and Transfers Perplexity is headquartered in San Francisco, California. There is currently **no EU data center option** — all queries are processed on US-based infrastructure. For German businesses, this means: - Every query submitted to Perplexity constitutes a transfer of personal data to a third country (US) under GDPR Chapter V - The Enterprise DPA’s SCCs must be executed before any personal data is processed - The Article 30 DSGVO processing register and employee privacy notices must document this international transfer - Data minimization applies: queries should be anonymized wherever possible to reduce the scope of personal data transferred Standard accounts have limited retention controls. Enterprise agreements include contractual data retention and deletion timelines — a meaningful compliance advantage. ## GDPR Roles: Controller or Processor? Under GDPR, the role distinction determines compliance obligations: **Your organization is the data controller.** You determine the purposes and means of using Perplexity — business research, legal analysis, competitive intelligence — and are responsible for the lawful basis under Article 6(1) DSGVO, privacy notices, and responding to data subject rights requests. **Perplexity is the data processor.** Under the Enterprise DPA, Perplexity processes data strictly according to your instructions and the DPA terms, and cannot use that data for its own purposes (such as model training). This controller-processor relationship only exists under the Enterprise plan with a signed DPA. Without a DPA, Perplexity operates under its own terms — the role structure is unclear, and the arrangement is non-compliant for business use involving personal data. ## Key Privacy Controls for Business Users Perplexity Enterprise provides several controls relevant to GDPR compliance: - **No training on your data:** The Enterprise plan contractually excludes query data from model training — this protection cannot be waived or changed - **Data retention configuration:** Contractual retention periods replace the default indefinite retention of consumer plans - **Team admin controls:** Enterprise admin dashboards allow user access management, usage monitoring, and policy enforcement - **SSO integration:** Supports enterprise identity providers for centralized access control - **Sub-processor transparency:** Enterprise customers receive a full list of Perplexity’s processing sub-processors For non-Enterprise users, Perplexity offers a “no history” toggle. This provides weaker guarantees — no contractual backing, no DPA, no SCC mechanism — and is not a substitute for an Enterprise DPA under GDPR. ## Perplexity AVV: Steps for German Businesses If your Perplexity use involves personal data, here is the compliance path: 1. **Upgrade to Perplexity Enterprise:** Contact Perplexity’s sales team. Free and Pro plans do not include a DPA. 2. **Sign the Data Processing Agreement:** Execute the DPA as the AVV required under Article 28 DSGVO. 3. **Confirm SCCs for EU-US transfers:** Verify Module 2 SCCs (Controller to Processor) are included. 4. **Conduct a Transfer Impact Assessment:** Evaluate Schrems II risk for your data types. 5. **Update your processing register:** Add Perplexity to your Verzeichnis von Verarbeitungstätigkeiten (Article 30 DSGVO). 6. **Update privacy notices:** Disclose Perplexity use and the US data transfer in employee-facing Datenschutzhinweise. 7. **Issue usage guidelines:** Train employees on which query types may and may not include personal data. 8. **Consult the Betriebsrat:** If Perplexity significantly affects employee workflows, works council involvement is required under §87(1) No. 6 BetrVG before company-wide rollout. ## Compliance Checklist for German Businesses Using Perplexity - [ ] **Use case assessment:** Determined whether queries involve personal data (names, client data, HR data) - [ ] **Enterprise plan:** Upgraded to Perplexity Enterprise if personal data is processed - [ ] **DPA / AVV signed:** Perplexity Data Processing Agreement executed before processing personal data - [ ] **SCCs confirmed:** Standard Contractual Clauses (Module 2) for EU-US transfers included in DPA - [ ] **Processing register updated:** Perplexity added to Art. 30 DSGVO register for relevant activities - [ ] **Legal basis documented:** Art. 6(1) GDPR basis identified for each use case (typically legitimate interest for business research) - [ ] **Privacy notices updated:** Employee-facing notices disclose Perplexity use and US data transfer - [ ] **Sub-processor list reviewed:** Perplexity sub-processors checked; notices updated accordingly - [ ] **Usage guidelines issued:** Staff trained on which query types may include personal data - [ ] **Data minimization applied:** Queries anonymized wherever possible - [ ] **Transfer Impact Assessment:** Schrems II analysis completed for EU-US transfers if sensitive data involved - [ ] **AI Act classification:** Confirmed no Perplexity use case falls under Annex III high-risk categories - [ ] **Works council consulted:** Betriebsrat notified before company-wide rollout under §87 BetrVG For guidance on AI tool compliance, DPA review, and GDPR risk assessments, see [Compound Law compliance services](https://compound.law/en-DE/compliance/). Compare AI tool GDPR guides: [Claude Enterprise GDPR](https://compound.law/en-DE/tools/claude-enterprise/) · [Cohere GDPR](https://compound.law/en-DE/tools/cohere/) · [AWS Bedrock GDPR](https://compound.law/en-DE/tools/aws-bedrock/) · [Hugging Face GDPR](https://compound.law/en-DE/tools/hugging-face/) *** ## Frequently Asked Questions ### Does Perplexity have a DPA for EU companies? Yes. Perplexity provides a Data Processing Agreement for Enterprise plan customers. The DPA functions as the Auftragsverarbeitungsvertrag (AVV) required under Article 28 GDPR, designates Perplexity as a processor, contractually prohibits Enterprise query data from being used for model training, and includes Standard Contractual Clauses (Module 2) for EU-US data transfers. Free and standard Pro accounts do not include a DPA. ### Is Perplexity GDPR compliant for business use? Perplexity can be GDPR compliant for business use if you are on the Enterprise plan with a signed DPA, Standard Contractual Clauses in place for EU-US data transfers, and your Article 30 DSGVO processing register and employee privacy notices updated. Without an Enterprise plan and DPA, processing personal data through Perplexity — even incidentally — is not GDPR compliant. ### Where does Perplexity store data? Perplexity stores and processes data on US-based infrastructure. There is currently no EU data center option. Queries submitted by EU users are transferred to US servers. Under the Enterprise DPA, Standard Contractual Clauses (Module 2) cover this EU-US transfer. German businesses must document this transfer in their Article 30 processing register and conduct a Transfer Impact Assessment for sensitive data categories. ### Can I use Perplexity in Germany under GDPR? Yes — but only with an Enterprise plan and signed DPA. Using Perplexity for business queries that include personal data on a free or Pro account violates GDPR. If your queries do not involve personal data — purely topic-based research with no individual names or identifying information — the absence of a DPA may be acceptable. However, most business use cases carry some risk of incidental personal data inclusion, and the Enterprise plan with a signed DPA is the only reliably compliant path for systematic business deployment in Germany. ### Does Perplexity train on my queries? For free and standard Pro accounts, Perplexity may use query data to improve its models under its standard terms. For Enterprise accounts, the DPA contractually prohibits using query data or outputs for model training or improvement. This is one of the most significant GDPR-relevant differences between Perplexity’s consumer and enterprise plans — and a core reason why the Enterprise plan is required for business use involving personal data. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Yes. Perplexity provides a Data Processing Agreement for Enterprise plan customers. The DPA functions as the Auftragsverarbeitungsvertrag (AVV) required under Article 28 GDPR, designates Perplexity as a processor, contractually prohibits Enterprise query data from being used for model training, and includes Standard Contractual Clauses (Module 2) for EU-US data transfers. Free and standard Pro accounts do not include a DPA. Perplexity can be GDPR compliant for business use if you are on the Enterprise plan with a signed DPA, Standard Contractual Clauses in place for EU-US data transfers, and your Article 30 DSGVO processing register and employee privacy notices updated. Without an Enterprise plan and DPA, processing personal data through Perplexity — even incidentally — is not GDPR compliant. Perplexity stores and processes data on US-based infrastructure. There is currently no EU data center option. Queries submitted by EU users are transferred to US servers. Under the Enterprise DPA, Standard Contractual Clauses (Module 2) cover this EU-US transfer. German businesses must document this transfer in their Article 30 processing register and conduct a Transfer Impact Assessment for sensitive data categories. Yes — but only with an Enterprise plan and signed DPA. Using Perplexity for business queries that include personal data on a free or Pro account violates GDPR. If your queries do not involve personal data — purely topic-based research with no individual names or identifying information — the absence of a DPA may be acceptable. However, most business use cases carry some risk of incidental personal data inclusion, and the Enterprise plan with a signed DPA is the only reliably compliant path for systematic business deployment in Germany. For free and standard Pro accounts, Perplexity may use query data to improve its models under its standard terms. For Enterprise accounts, the DPA contractually prohibits using query data or outputs for model training or improvement. This is one of the most significant GDPR-relevant differences between Perplexity's consumer and enterprise plans — and a core reason why the Enterprise plan is required for business use involving personal data. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Is Perplexity AI GDPR Compliant? Yes — on Enterprise, With a DPA", "description": "Yes — but only on the Enterprise plan with a signed DPA. Free and Pro plans have no DPA, and US storage makes SCCs mandatory for German businesses.", "image": "https://compound.law/assets/images/tools/tools_4.webp", "datePublished": "2026-04-16T00:00:00.000Z", "dateModified": "2026-04-16T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/perplexity/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Is Perplexity AI GDPR Compliant? Yes — on Enterprise, With a DPA", "item": "https://compound.law/en-DE/tools/perplexity/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does Perplexity have a DPA for EU companies?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Perplexity provides a Data Processing Agreement for Enterprise plan customers. The DPA functions as the Auftragsverarbeitungsvertrag (AVV) required under Article 28 GDPR, designates Perplexity as a processor, contractually prohibits Enterprise query data from being used for model training, and includes Standard Contractual Clauses (Module 2) for EU-US data transfers. Free and standard Pro accounts do not include a DPA." } }, { "@type": "Question", "name": "Is Perplexity GDPR compliant for business use?", "acceptedAnswer": { "@type": "Answer", "text": "Perplexity can be GDPR compliant for business use if you are on the Enterprise plan with a signed DPA, Standard Contractual Clauses in place for EU-US data transfers, and your Article 30 DSGVO processing register and employee privacy notices updated. Without an Enterprise plan and DPA, processing personal data through Perplexity — even incidentally — is not GDPR compliant." } }, { "@type": "Question", "name": "Where does Perplexity store data?", "acceptedAnswer": { "@type": "Answer", "text": "Perplexity stores and processes data on US-based infrastructure. There is currently no EU data center option. Queries submitted by EU users are transferred to US servers. Under the Enterprise DPA, Standard Contractual Clauses (Module 2) cover this EU-US transfer. German businesses must document this transfer in their Article 30 processing register and conduct a Transfer Impact Assessment for sensitive data categories." } }, { "@type": "Question", "name": "Can I use Perplexity in Germany under GDPR?", "acceptedAnswer": { "@type": "Answer", "text": "Yes — but only with an Enterprise plan and signed DPA. Using Perplexity for business queries that include personal data on a free or Pro account violates GDPR. If your queries do not involve personal data — purely topic-based research with no individual names or identifying information — the absence of a DPA may be acceptable. However, most business use cases carry some risk of incidental personal data inclusion, and the Enterprise plan with a signed DPA is the only reliably compliant path for systematic business deployment in Germany." } }, { "@type": "Question", "name": "Does Perplexity train on my queries?", "acceptedAnswer": { "@type": "Answer", "text": "For free and standard Pro accounts, Perplexity may use query data to improve its models under its standard terms. For Enterprise accounts, the DPA contractually prohibits using query data or outputs for model training or improvement. This is one of the most significant GDPR-relevant differences between Perplexity's consumer and enterprise plans — and a core reason why the Enterprise plan is required for business use involving personal data." } } ] } ] ```