--- title: "Synthesia GDPR: Training, DPA & German Compliance Facts" description: "No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/synthesia/" language: "en" --- ![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp) tools # Synthesia GDPR: Training, DPA & German Compliance Facts 7 October 2026 Does Synthesia train on customer content — and is it GDPR compliant? No. Synthesia does not use customer content — inputs or outputs — to pre-train its AI components, and fine-tuning on your data requires your written instruction. It offers an Art. 28 Data Processing Addendum and stores customer data in the EU (AWS Ireland), so German companies can deploy it in a GDPR-compliant setup. - No training on customer content: Synthesia states it does not use Customer Data, inputs or outputs, to pre-train its AI components. - Any fine-tuning of AI components that processes customer data requires the customer's written instruction under the governing agreement. - GDPR facts: Art. 28 Data Processing Addendum available; customer data stored in the EU on AWS in Ireland, secondary backups in Frankfurt. - German rollouts still need a legal-basis check and works council engagement under §87 BetrVG where employees are affected. **No — Synthesia does not train on customer content.** Synthesia’s AI Governance Practices state plainly that it “does not use Customer Data, including inputs or outputs, to pre-train its AI components.” And Synthesia is GDPR-usable for German companies: the company offers an **Article 28 GDPR Data Processing Addendum (DPA)** and stores customer data in the EU, on AWS infrastructure in Ireland. No tool is “GDPR compliant” as a badge — compliance depends on your use — but the facts that matter for a German deployment are verifiable and set out below. Our [AI tools guide](https://compound.law/en-DE/tools/) covers the full range of AI video and media tools reviewed for enterprise use in Germany. **Verified: October 2026**, from Synthesia’s documents: Customer Terms of Service (effective July 20, 2026), Data Processing Agreement page (updated July 22, 2026), AI Governance Practices, and Security Practices (updated February 3, 2026). ## Does Synthesia train on customer content? No. Synthesia does not use Customer Data — your inputs or your generated outputs — to pre-train its AI components. The nuance matters for vendor reviews. Synthesia pre-trains its avatar models on performances by paid actors it commissions, performances made public, and licensed material — not on customer scripts or videos. Where processing of customer data would result in **fine-tuning** of AI components, the customer’s written instruction is required under the governing agreement. The Customer Terms reinforce this: usage information may be used to improve the Services, but never to fine-tune AI components beyond those integrated in your own tenant, and never to create standalone AI models. ## Is Synthesia GDPR compliant for German companies? GDPR does not certify products — it applies to **your** processing, with Synthesia as processor and your organisation as controller. What can be verified are the building blocks a German deployment needs, and Synthesia documents them: | GDPR fact | Status (verified October 2026) | | ---------------------------- | ---------------------------------------------------------------------- | | Training on customer content | No — inputs and outputs excluded from pre-training | | Fine-tuning on customer data | Only on the customer’s written instruction | | DPA (AVV equivalent) | Art. 28 Data Processing Addendum, incorporated into the Customer Terms | | Data storage | EU — AWS Ireland; secondary backups in AWS Frankfurt | | Third-country transfers | SCCs via AWS DPA; transfer impact assessment published | | Deletion | Within up to 90 days of request or termination | | Certifications | SOC 2 Type II, ISO 27001, ISO/IEC 42001 audits | Two honest caveats. First, the contracting entity for European customers is **Synthesia Limited**, a UK-incorporated company contracting under Irish law — the DPA and SCC framework govern the transfer mechanics, but if your vendor policy requires an EU-incorporated processor, check this point in procurement. Second, executing the DPA, defining your legal basis, and documenting data categories remain your tasks — they do not happen automatically. [AI video generation compliance](https://compound.law/en-DE/compliance/ai-video-generation/) and [AI voice assistant compliance](https://compound.law/en-DE/compliance/ai-voice-assistants/) explain the specific AI Act obligations for synthetic avatars and voices. ## EU AI Act: your role as deployer Under the EU AI Act, your obligations depend on how you use Synthesia. When you use the Services, your organisation takes the **deployer** role and Synthesia acts as the provider. General productivity and training-video use typically falls under minimal or limited risk; Synthesia states that its AI components, used as intended and per its Acceptable Use Policy, are not high-risk AI systems to its knowledge. Transparency still matters: freemium videos carry watermarks by default, and paying customers can embed audio or visual disclosure markers — relevant for synthetic media obligations under Article 50. Sector-specific requirements for AI-generated training and corporate content are covered in the [media and entertainment AI compliance](https://compound.law/en-DE/ai-act-industries/media-entertainment/) guide. ## Works council requirements If Synthesia affects how employees work in Germany, the **Betriebsrat** may have co-determination rights under §87 BetrVG. This is especially relevant if the tool could monitor activity, affect performance evaluation, or significantly change work processes. Engage your works council early — explain the tool, address concerns, and agree on appropriate use policies. ## What This Means Practically For most German businesses, Synthesia is deployable with proper preparation: execute the DPA, confirm the EU storage setup matches your requirements, assess your legal basis, engage the works council if employees are affected, train employees on appropriate use, and document your compliance approach. ## How Compound Law Helps - Deployment assessment for Synthesia - DPA review and gap analysis - Works council coordination where needed - Usage policy development - Ongoing compliance monitoring This page is general information, not legal advice — specific situations require individual legal counsel. ## Frequently Asked Questions ### Does Synthesia train on customer content? No. Synthesia’s AI Governance Practices state that it does not use Customer Data, including inputs or outputs, to pre-train its AI components. Pre-training relies on performances by paid actors Synthesia commissions, public performances, and licensed material. Any processing of customer data that results in fine-tuning is subject to the customer’s written instruction under the governing agreement. ### Is Synthesia GDPR compliant? No AI tool is “GDPR compliant” as a badge — GDPR applies to your processing, not to the product. The verifiable facts for a German deployment: Synthesia offers an Art. 28 Data Processing Addendum, stores customer data in the EU on AWS in Ireland, commits not to train on customer content, and holds SOC 2 Type II, ISO 27001, and ISO/IEC 42001 audits. Whether your specific use is compliant depends on your legal basis, data categories, and internal governance — that assessment is case-specific. ### Does Synthesia offer a DPA? Yes. Synthesia publishes a Data Processing Addendum that supplements its Customer Terms of Service, and the Customer Terms incorporate it by reference. When you use the Services, your organisation is the controller and Synthesia acts as processor under GDPR. For European customers the contracting entity is Synthesia Limited, with Irish law and Dublin as the agreed venue. ### Where does Synthesia store data? In the EU. Synthesia’s Security Practices state that customer data is stored on AWS infrastructure in Ireland, with operational backups in Ireland and secondary backups in the AWS Frankfurt region. Transfers from the EU to the USA within AWS services are safeguarded by Standard Contractual Clauses in AWS’s DPA, and Synthesia has published a transfer impact assessment. Deletion happens within up to 90 days of a deletion request or account termination. ### Do we need works council approval in Germany? Possibly. If Synthesia affects how employees work — for example if it could monitor behaviour, influence performance evaluation, or materially change workflows — the works council has co-determination rights under §87 BetrVG. Engage the Betriebsrat early, explain the use case, and agree on a usage policy before rollout. ### What about the EU AI Act? When you use Synthesia, your organisation is the deployer and Synthesia is the provider under the EU AI Act. Synthesia states that its AI components, used as intended and per its Acceptable Use Policy, are not classified as high-risk AI systems to its knowledge. For transparency, freemium videos carry watermarks by default, and paying customers can add audio or visual disclosure markers — relevant for synthetic media under Article 50. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) [![Claude ZDR zero data retention guide for Anthropic API and Claude Code enterprise use](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-zdr/) [tools](https://compound.law/en-DE/tools/claude-zdr/) ### [Claude ZDR: What It Covers, Who Qualifies, How to Get It](https://compound.law/en-DE/tools/claude-zdr/) [Claude ZDR is available for the Anthropic API and Claude Code. See which plans qualify, what's excluded, and how to request enablement for your organization.](https://compound.law/en-DE/tools/claude-zdr/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) - [Claude Team Plan DPA & GDPR Compliance Guide tools](https://compound.law/en-DE/tools/claude-team-gdpr/) ## Frequently asked questions No. Synthesia's AI Governance Practices state that it does not use Customer Data, including inputs or outputs, to pre-train its AI components. Pre-training relies on performances by paid actors Synthesia commissions, public performances, and licensed material. Any processing of customer data that results in fine-tuning is subject to the customer's written instruction under the governing agreement. No AI tool is 'GDPR compliant' as a badge — GDPR applies to your processing, not to the product. The verifiable facts for a German deployment: Synthesia offers an Art. 28 Data Processing Addendum, stores customer data in the EU on AWS in Ireland, commits not to train on customer content, and holds SOC 2 Type II, ISO 27001, and ISO/IEC 42001 audits. Whether your specific use is compliant depends on your legal basis, data categories, and internal governance — that assessment is case-specific. Yes. Synthesia publishes a Data Processing Addendum that supplements its Customer Terms of Service, and the Customer Terms incorporate it by reference. When you use the Services, your organisation is the controller and Synthesia acts as processor under GDPR. For European customers the contracting entity is Synthesia Limited, with Irish law and Dublin as the agreed venue. In the EU. Synthesia's Security Practices state that customer data is stored on AWS infrastructure in Ireland, with operational backups in Ireland and secondary backups in the AWS Frankfurt region. Transfers from the EU to the USA within AWS services are safeguarded by Standard Contractual Clauses in AWS's DPA, and Synthesia has published a transfer impact assessment. Deletion happens within up to 90 days of a deletion request or account termination. Possibly. If Synthesia affects how employees work — for example if it could monitor behaviour, influence performance evaluation, or materially change workflows — the works council has co-determination rights under §87 BetrVG. Engage the Betriebsrat early, explain the use case, and agree on a usage policy before rollout. When you use Synthesia, your organisation is the deployer and Synthesia is the provider under the EU AI Act. Synthesia states that its AI components, used as intended and per its Acceptable Use Policy, are not classified as high-risk AI systems to its knowledge. For transparency, freemium videos carry watermarks by default, and paying customers can add audio or visual disclosure markers — relevant for synthetic media under Article 50. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Synthesia GDPR: Training, DPA & German Compliance Facts", "description": "No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.", "image": "https://compound.law/assets/images/tools/tools_4.webp", "datePublished": "2026-10-07T00:00:00.000Z", "dateModified": "2026-10-07T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/synthesia/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Synthesia GDPR: Training, DPA & German Compliance Facts", "item": "https://compound.law/en-DE/tools/synthesia/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does Synthesia train on customer content?", "acceptedAnswer": { "@type": "Answer", "text": "No. Synthesia's AI Governance Practices state that it does not use Customer Data, including inputs or outputs, to pre-train its AI components. Pre-training relies on performances by paid actors Synthesia commissions, public performances, and licensed material. Any processing of customer data that results in fine-tuning is subject to the customer's written instruction under the governing agreement." } }, { "@type": "Question", "name": "Is Synthesia GDPR compliant?", "acceptedAnswer": { "@type": "Answer", "text": "No AI tool is 'GDPR compliant' as a badge — GDPR applies to your processing, not to the product. The verifiable facts for a German deployment: Synthesia offers an Art. 28 Data Processing Addendum, stores customer data in the EU on AWS in Ireland, commits not to train on customer content, and holds SOC 2 Type II, ISO 27001, and ISO/IEC 42001 audits. Whether your specific use is compliant depends on your legal basis, data categories, and internal governance — that assessment is case-specific." } }, { "@type": "Question", "name": "Does Synthesia offer a DPA?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Synthesia publishes a Data Processing Addendum that supplements its Customer Terms of Service, and the Customer Terms incorporate it by reference. When you use the Services, your organisation is the controller and Synthesia acts as processor under GDPR. For European customers the contracting entity is Synthesia Limited, with Irish law and Dublin as the agreed venue." } }, { "@type": "Question", "name": "Where does Synthesia store data?", "acceptedAnswer": { "@type": "Answer", "text": "In the EU. Synthesia's Security Practices state that customer data is stored on AWS infrastructure in Ireland, with operational backups in Ireland and secondary backups in the AWS Frankfurt region. Transfers from the EU to the USA within AWS services are safeguarded by Standard Contractual Clauses in AWS's DPA, and Synthesia has published a transfer impact assessment. Deletion happens within up to 90 days of a deletion request or account termination." } }, { "@type": "Question", "name": "Do we need works council approval in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "Possibly. If Synthesia affects how employees work — for example if it could monitor behaviour, influence performance evaluation, or materially change workflows — the works council has co-determination rights under §87 BetrVG. Engage the Betriebsrat early, explain the use case, and agree on a usage policy before rollout." } }, { "@type": "Question", "name": "What about the EU AI Act?", "acceptedAnswer": { "@type": "Answer", "text": "When you use Synthesia, your organisation is the deployer and Synthesia is the provider under the EU AI Act. Synthesia states that its AI components, used as intended and per its Acceptable Use Policy, are not classified as high-risk AI systems to its knowledge. For transparency, freemium videos carry watermarks by default, and paying customers can add audio or visual disclosure markers — relevant for synthetic media under Article 50." } } ] } ] ```