--- title: "Salesforce and GDPR: What German Companies Need to Know in 2026" description: "Salesforce GDPR compliance for Germany: DPA execution, Frankfurt data residency, BSI C5 certification, and Betriebsrat requirements in 2026." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/salesforce/" language: "en" --- ![Salesforce CRM GDPR compliance for German companies](https://compound.law/assets/images/tools/server.webp) tools # Salesforce and GDPR: What German Companies Need to Know in 2026 15 April 2026 **Yes, Salesforce can be used GDPR-compliantly in Germany.** Salesforce provides a Data Processing Addendum (DPA — known in Germany as an Auftragsverarbeitungsvertrag or AVV), operates data centers in Frankfurt, and holds BSI C5 attestation. However, these protections are not automatic: you must execute the DPA, configure EU data residency, and address Works Council requirements before going live. This guide covers the current compliance landscape for Salesforce Sales Cloud, Service Cloud, and Marketing Cloud under German and EU data protection law. For Salesforce Einstein AI features, see our dedicated [Salesforce Einstein GDPR guide](https://compound.law/en-DE/tools/salesforce-einstein/). ## Is Salesforce GDPR-Compliant for German Companies? Yes — with conditions. Salesforce acts as a **data processor** under Art. 4(8) GDPR (Regulation (EU) 2016/679) when processing personal data on behalf of your business. Your company, as the data controller, must satisfy four core requirements before using Salesforce to handle personal data: - **Execute the Salesforce DPA/AVV** to fulfil Art. 28 GDPR requirements - **Configure EU data residency** to keep personal data within the European Economic Area - **Review Salesforce’s sub-processor list** and assess any third-country data transfers - **Establish a legal basis** — typically contractual necessity (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) — for CRM data processing Salesforce is one of the most GDPR-mature enterprise platforms available to German companies. The **March 2026 DPA update** further strengthened its compliance documentation, making Salesforce a straightforward choice from a data protection standpoint — provided you take the required setup steps. ## Salesforce DPA: What’s Covered Under **Art. 28 GDPR**, every organisation using a third-party service to process personal data must have a written Data Processing Agreement in place. In Germany, this is the **Auftragsverarbeitungsvertrag (AVV)**. Salesforce updated its Data Processing Addendum in **March 2026**. The updated DPA covers: - A precise description of all processing activities across Salesforce products - Categories of data subjects and personal data processed - Technical and organisational measures (TOMs) aligned with ISO 27001 and BSI C5 - Sub-processor management, notification obligations, and approval processes - Data subject rights assistance under Arts. 15–22 GDPR - Procedures for data return or deletion upon contract termination - Updated Standard Contractual Clauses for third-country transfers **How to execute the Salesforce DPA:** 1. Log in to Salesforce Trust (trust.salesforce.com) or your Salesforce account dashboard 2. Navigate to the legal agreements or privacy section 3. Accept Salesforce’s standard DPA — this is a pre-signed online agreement for most Salesforce products, requiring no individual negotiation 4. Download and archive the signed DPA for your compliance records and vendor management file For German companies, the DPA should also address compliance with the **Bundesdatenschutzgesetz (BDSG)** — particularly §26 BDSG where employee personal data processed in Salesforce (e.g. sales representative performance data) is involved. ## EU Data Residency: The Frankfurt Data Center Salesforce operates data centers in **Frankfurt, Germany**, as part of its EU infrastructure. For German companies with EU data residency enabled, primary personal data — including CRM records, contact information, and customer interaction history — is stored and processed within the European Economic Area (EEA). Key points for German companies: - **EU data residency is a subscription-tier feature**, not a default setting. Confirm whether your Salesforce contract includes it and request written confirmation of the data storage location for your instance - **Metadata and operational data** (logs, backup infrastructure, support operations) may still involve data flows outside the EEA — covered by Standard Contractual Clauses in Salesforce’s DPA - **Marketing Cloud** has historically maintained separate data residency infrastructure; confirm EU residency scope for Marketing Cloud separately if your organisation uses it - **Service Cloud contact center features** and telephony integrations may route data through additional sub-processors — always verify the current sub-processor list before enabling these features Document the confirmed data residency configuration in your Records of Processing Activities (RoPA) under Art. 30 GDPR. ## Standard Contractual Clauses and the EU-US Data Privacy Framework Salesforce, as a US-headquartered company, processes some data in the United States. The legal framework for these transfers relies on two mechanisms: **Standard Contractual Clauses (SCCs):** Salesforce’s DPA incorporates the updated EU SCCs issued by the European Commission in June 2021 (Decision 2021/914). These clauses govern all EU-to-US personal data transfers and address the requirements established following the Schrems II ruling (*Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems*, C-311/18). **EU-US Data Privacy Framework (DPF):** Salesforce is certified under the EU-US Data Privacy Framework, which came into effect in July 2023 and was upheld by the CJEU in July 2024. DPF certification provides an additional legal mechanism for transatlantic data transfers and requires participating organisations to meet rigorous data protection standards. For German companies: both mechanisms together give transatlantic Salesforce data transfers a solid legal foundation. Nevertheless, document your **Transfer Impact Assessment (TIA)** to demonstrate due diligence — German data protection authorities (Datenschutzaufsichtsbehörden, particularly the LfDI and BayLDA) have signalled continued scrutiny of US cloud services. ## BSI C5 Certification and Other Security Certifications **BSI C5** (Cloud Computing Compliance Criteria Catalogue) is the German Federal Office for Information Security’s cloud security standard. Salesforce holds BSI C5 attestation — a significant differentiator for German enterprise procurement, public sector contracts, and regulated industry deployments. Salesforce’s current certification portfolio relevant to German organisations: | Certification | Relevance | | ----------------- | ------------------------------------------------------------------------------------------------- | | **BSI C5** | German cloud security standard — required for many public sector and regulated industry contracts | | **ISO 27001** | International information security management standard — globally recognised | | **SOC 2 Type II** | Annual operational security attestation — available under NDA from Salesforce | | **ISO 27017** | Cloud-specific security controls | | **ISO 27018** | Protection of personal data in cloud environments | Request BSI C5 attestation documentation directly from your Salesforce account team for procurement purposes. Current attestations are valid for specific Salesforce services; verify that the products you are procuring are within the certified scope. ## Works Council (Betriebsrat) Considerations Salesforce deployments frequently trigger **co-determination rights under §87(1) No. 6 BetrVG** — the Works Constitution Act — because the platform enables technical monitoring of employee behaviour and performance. Specific scenarios where Works Council involvement is required: - **Salesforce Sales Cloud:** Pipeline management, activity tracking, call logging, and sales performance dashboards can be used to monitor individual employee performance and productivity - **Salesforce Service Cloud:** Call centre queue management, case resolution times, customer satisfaction scores tied to individual agents, and SLA compliance tracking are classic §87 BetrVG use cases - **Salesforce Marketing Cloud:** Campaign attribution data and email engagement metrics that can be linked to individual marketing team members **Recommended approach:** 1. Conduct a pre-deployment assessment of all Salesforce features that could enable employee monitoring 2. Engage the Betriebsrat **before** rollout — not after 3. Negotiate a **Betriebsvereinbarung** (works agreement) that defines permitted uses, data retention, access controls, and employee rights 4. Use Salesforce’s admin controls to disable or restrict monitoring features not covered by the Betriebsvereinbarung 5. Document the Betriebsvereinbarung in your RoPA Works Council negotiations for Salesforce CRM deployments are a core part of what we handle at Compound Law. For the full legal framework on employee data monitoring, see our [AI employee monitoring compliance guide](https://compound.law/en-DE/compliance/ai-employee-monitoring/). ## Salesforce Einstein and AI Features: A Separate Compliance Layer Salesforce Einstein — Einstein Lead Scoring, Einstein GPT, Conversation Intelligence, and other AI-driven features — introduces additional GDPR obligations beyond the core CRM platform. Key concerns include Art. 22 GDPR automated decision-making requirements, DPIA obligations for large-scale profiling, and EU AI Act compliance for high-risk use cases in [professional services](https://compound.law/en-DE/ai-act/professional-services/) and customer-facing deployments. The Salesforce Einstein compliance framework is covered in detail in our dedicated guide. See our [Salesforce Einstein GDPR guide](https://compound.law/en-DE/tools/salesforce-einstein/) before activating AI features in your Salesforce instance. For AI-assisted customer service using Salesforce Service Cloud, also review our [AI customer service compliance guide](https://compound.law/en-DE/compliance/ai-customer-service/). ## Our Assessment Salesforce is one of the most compliance-mature enterprise CRM platforms available in Germany. The March 2026 DPA update, BSI C5 attestation, Frankfurt data center, and EU-US DPF certification together give German companies a strong legal foundation for Salesforce deployment. The key compliance risks are not the platform itself, but **configuration and process gaps**: failing to execute the DPA before going live, deploying Salesforce without Works Council involvement, or activating Einstein AI features without assessing Art. 22 GDPR obligations. **Before going live with Salesforce, complete these steps:** 1. Execute the Salesforce DPA/AVV and archive a signed copy 2. Confirm and document EU data residency configuration in writing 3. Review the Salesforce sub-processor list and conduct a Transfer Impact Assessment 4. Add Salesforce to your RoPA under Art. 30 GDPR 5. Engage your Works Council and negotiate a Betriebsvereinbarung where required 6. Assess Einstein AI features separately using our [Einstein compliance guide](https://compound.law/en-DE/tools/salesforce-einstein/) [Contact Compound Law](https://compound.law/en-DE/#booking) for a Salesforce GDPR readiness assessment tailored to your organisation. ## Frequently Asked Questions ### Is Salesforce GDPR compliant? Yes. Salesforce provides a comprehensive Data Processing Addendum (updated March 2026), operates data centers in Frankfurt, holds BSI C5 and ISO 27001 certifications, and is certified under the EU-US Data Privacy Framework. GDPR compliance requires the controller — your organisation — to execute the DPA, configure EU data residency, and establish appropriate legal bases for processing before going live. ### Does Salesforce have a DPA for Germany? Yes. Salesforce provides a standard Data Processing Addendum accessible through Salesforce Trust (trust.salesforce.com) and the Salesforce contract portal. This DPA satisfies Art. 28 GDPR requirements and includes the AVV provisions required under German data protection law. It does not require individual negotiation and can be accepted online. ### Where does Salesforce store data for EU customers? Salesforce operates data centers in Frankfurt and other EU locations. EU data residency — keeping primary personal data within the EEA — is available as a subscription feature. Confirm whether your contract includes EU data residency, enable it in your Salesforce org settings, and request written confirmation of the data storage scope for your specific instance. ### Is Salesforce BSI C5 certified? Yes. Salesforce holds BSI C5 attestation for its cloud services. BSI C5 is the German Federal Office for Information Security’s cloud security criteria catalogue and is required for many public sector contracts and regulated industry deployments in Germany. Request the current attestation documentation from your Salesforce account team. ### Do I need to involve the Works Council for Salesforce? Usually yes, if your Salesforce deployment includes features that enable monitoring of employee performance, behaviour, or productivity. Under §87(1) No. 6 BetrVG, the Works Council has mandatory co-determination rights for technical monitoring systems. Engage the Betriebsrat before rollout and negotiate a Betriebsvereinbarung to govern Salesforce use. *** *The information on this page is general guidance on Salesforce GDPR compliance and does not constitute legal advice. Your specific situation may require individual legal assessment. [Contact Compound Law](https://compound.law/en-DE/#booking) for tailored Salesforce compliance support.* ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Yes. Salesforce provides a comprehensive Data Processing Addendum (updated March 2026), operates data centers in Frankfurt, holds BSI C5 and ISO 27001 certifications, and is certified under the EU-US Data Privacy Framework. GDPR compliance requires the controller — your organisation — to execute the DPA, configure EU data residency, and establish appropriate legal bases for processing before going live. Yes. Salesforce provides a standard Data Processing Addendum accessible through Salesforce Trust (trust.salesforce.com) and the Salesforce contract portal. This DPA satisfies Art. 28 GDPR requirements and includes the AVV provisions required under German data protection law. It does not require individual negotiation and can be accepted online. Salesforce operates data centers in Frankfurt and other EU locations. EU data residency — keeping primary personal data within the EEA — is available as a subscription feature. Confirm whether your contract includes EU data residency, enable it in your Salesforce org settings, and request written confirmation of the data storage scope for your specific instance. Yes. Salesforce holds BSI C5 attestation for its cloud services. BSI C5 is the German Federal Office for Information Security's cloud security criteria catalogue and is required for many public sector contracts and regulated industry deployments in Germany. Request the current attestation documentation from your Salesforce account team. Usually yes, if your Salesforce deployment includes features that enable monitoring of employee performance, behaviour, or productivity. Under §87(1) No. 6 BetrVG, the Works Council has mandatory co-determination rights for technical monitoring systems. Engage the Betriebsrat before rollout and negotiate a Betriebsvereinbarung to govern Salesforce use. --- \*The information on this page is general guidance on Salesforce GDPR compliance and does not constitute legal advice. Your specific situation may require individual legal assessment. \[Contact Compound Law]\(/en-DE/#booking) for tailored Salesforce compliance support.\* ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Salesforce and GDPR: What German Companies Need to Know in 2026", "description": "Salesforce GDPR compliance for Germany: DPA execution, Frankfurt data residency, BSI C5 certification, and Betriebsrat requirements in 2026.", "image": "https://compound.law/assets/images/tools/server.webp", "datePublished": "2026-04-15T00:00:00.000Z", "dateModified": "2026-04-15T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/salesforce/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Salesforce and GDPR: What German Companies Need to Know in 2026", "item": "https://compound.law/en-DE/tools/salesforce/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is Salesforce GDPR compliant?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Salesforce provides a comprehensive Data Processing Addendum (updated March 2026), operates data centers in Frankfurt, holds BSI C5 and ISO 27001 certifications, and is certified under the EU-US Data Privacy Framework. GDPR compliance requires the controller — your organisation — to execute the DPA, configure EU data residency, and establish appropriate legal bases for processing before going live." } }, { "@type": "Question", "name": "Does Salesforce have a DPA for Germany?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Salesforce provides a standard Data Processing Addendum accessible through Salesforce Trust (trust.salesforce.com) and the Salesforce contract portal. This DPA satisfies Art. 28 GDPR requirements and includes the AVV provisions required under German data protection law. It does not require individual negotiation and can be accepted online." } }, { "@type": "Question", "name": "Where does Salesforce store data for EU customers?", "acceptedAnswer": { "@type": "Answer", "text": "Salesforce operates data centers in Frankfurt and other EU locations. EU data residency — keeping primary personal data within the EEA — is available as a subscription feature. Confirm whether your contract includes EU data residency, enable it in your Salesforce org settings, and request written confirmation of the data storage scope for your specific instance." } }, { "@type": "Question", "name": "Is Salesforce BSI C5 certified?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Salesforce holds BSI C5 attestation for its cloud services. BSI C5 is the German Federal Office for Information Security's cloud security criteria catalogue and is required for many public sector contracts and regulated industry deployments in Germany. Request the current attestation documentation from your Salesforce account team." } }, { "@type": "Question", "name": "Do I need to involve the Works Council for Salesforce?", "acceptedAnswer": { "@type": "Answer", "text": "Usually yes, if your Salesforce deployment includes features that enable monitoring of employee performance, behaviour, or productivity. Under §87(1) No. 6 BetrVG, the Works Council has mandatory co-determination rights for technical monitoring systems. Engage the Betriebsrat before rollout and negotiate a Betriebsvereinbarung to govern Salesforce use. --- *The information on this page is general guidance on Salesforce GDPR compliance and does not constitute legal advice. Your specific situation may require individual legal assessment. [Contact Compound Law](/en-DE/#booking) for tailored Salesforce compliance support.*" } } ] } ] ```