--- title: "Is Zendesk GDPR Compliant in Germany? Yes — With DPA and EU Residency" description: "Yes — Zendesk can be GDPR-compliant in Germany: signed DPA, EU data residency on qualifying enterprise plans, and works council checks for agent analytics." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/zendesk/" language: "en" --- ![Zendesk GDPR and DPA compliance for companies in Germany](https://compound.law/assets/images/tools/tools_2.webp) tools # Is Zendesk GDPR Compliant in Germany? Yes — With DPA and EU Residency 6 April 2026 Is Zendesk GDPR compliant for companies in Germany? Zendesk can be used in a GDPR-compliant way in Germany, but compliance requires a signed DPA, verification of EU data residency options, assessment of subprocessors, and a careful approach to customer data, ticket content, and agent monitoring features that can raise both GDPR and labor law concerns. - Zendesk offers a Data Processing Agreement covering Article 28 GDPR — sign it and verify subprocessors, transfer clauses, and data deletion terms. - EU data residency for ticket and customer data is available for qualifying enterprise plans — standard plans process data in the US. - Zendesk features that surface agent metrics, CSAT trends, or activity data may require works council (Betriebsrat) consultation in Germany. **Yes — Zendesk can be GDPR-compliant in Germany, but only with three things in place: a signed Data Processing Agreement, EU data residency on a qualifying enterprise plan, and a works council review wherever agent analytics surface employee performance data.** Standard plans process ticket data in the US, and ticket content, chat logs, and attachments routinely contain personal data — so the DPA alone is not the compliance outcome. German companies must assess EU data residency, subprocessors, transfer mechanisms, and the labor law implications of agent monitoring features before deploying or expanding Zendesk, the dominant customer service platform for German enterprises and startups. For a broader overview of customer service and productivity tools reviewed for the German market, see the [AI tools guide](https://compound.law/en-DE/tools/). > **Short answer** > > Yes, but with careful configuration and a DPA review. > > - Sign the Zendesk DPA and verify it covers your data categories, subprocessors, and residency setup. > - EU data residency requires an enterprise-level plan — standard plans process ticket data in the US. > - Zendesk agent analytics, CSAT reporting, and AI features that surface employee metrics may require works council involvement in Germany. This page provides general information, not legal advice for a specific deployment. For related guidance, see our [AI customer service compliance guide](https://compound.law/en-DE/compliance/ai-customer-service/) and our guides on [HubSpot GDPR](https://compound.law/en-DE/tools/hubspot/) and [Zapier GDPR](https://compound.law/en-DE/tools/zapier/) for customer data workflow tools. ## Does Zendesk Have a Data Processing Agreement (DPA)? Yes. Zendesk provides a **Data Processing Agreement** that governs its role as a processor where it processes personal data on behalf of its customers. The DPA is designed to address **Article 28 GDPR** requirements — the mandatory contract between data controllers and processors. German companies should go beyond confirming the DPA exists and verify: - that the DPA is accepted or signed for their specific Zendesk account and plan - that the DPA covers all data categories flowing through Zendesk in their specific workflows — tickets, customer profiles, chat logs, attachments - how Zendesk’s **subprocessors** are disclosed, including cloud infrastructure, analytics providers, and AI model vendors - what data **retention and deletion terms** apply to ticket data, customer records, attachments, and exported data after contract termination - whether the **transfer clauses** address cross-border data flows under their plan configuration - how **security incidents** are handled and what notification obligations Zendesk provides Zendesk has been privately held since 2022 and its corporate structure may affect how DPA terms are structured across different product lines. Companies using multiple Zendesk products (Zendesk Support, Zendesk Chat, Zendesk Sell, Zendesk AI) should confirm whether the same DPA covers all products in use. ## Where Does Zendesk Store Data? EU Data Residency Data residency is a critical question for German companies evaluating Zendesk. The answer depends on the plan: | Plan level | Data residency | Default processing location | | ----------------------------- | --------------------------------------- | --------------------------- | | Standard / Suite plans | US-based (with SCC transfer safeguards) | United States | | Enterprise / qualifying plans | EU data residency option available | Configurable | **Standard and Suite plans:** Customer and ticket data is processed in the **United States** by default. International transfers are covered by **Standard Contractual Clauses (SCCs)** as part of the Zendesk DPA, but data does not reside in the EEA as a default configuration. **Enterprise plans with EU data residency:** Zendesk offers EU-hosted data residency for qualifying enterprise customers. When enabled, customer account data, ticket data, and associated content is stored and processed in **EU-based data centers**. This is the configuration most German companies with strict data residency requirements will need to request and verify. For any company processing significant volumes of customer personal data through Zendesk — particularly in regulated sectors — confirming the exact data residency configuration in writing is a practical compliance necessity, not just a nice-to-have. ## Zendesk and GDPR: Obligations for German Businesses ### Categories of data in Zendesk Zendesk typically processes several distinct categories of personal data. Each requires its own legal basis analysis: - **Customer contact data** — names, email addresses, phone numbers, account information - **Ticket and conversation content** — the substance of customer inquiries, support history, free-text messages - **Attachments and files** — which can contain anything from receipts to medical documentation - **Customer satisfaction (CSAT) data** — survey responses and ratings linked to individual tickets - **Agent activity data** — response times, ticket handling metrics, chat logs, performance data Ticket and conversation content is often the highest-risk data category because customers frequently share sensitive personal information in support contexts — health details, financial information, account credentials, or special category data — that your organization did not specifically solicit but must still manage under GDPR. ### Data minimization and ticket content A practical GDPR step for Zendesk is **workflow and form design**. Companies should: - configure customer-facing forms to collect only the data necessary for support resolution - review which ticket fields are mandatory versus optional - implement processes to remove or redact sensitive data from ticket content that is not needed for ongoing resolution - check whether email-to-ticket configurations bring in more personal data than intended (e.g., full email threads with third-party information) ### Subprocessors and third-party integrations Zendesk uses multiple subprocessors for cloud infrastructure, support operations, and analytics. Each Zendesk integration — CRM, e-commerce platform, communication tool — also creates additional processor or controller relationships. German companies should: - review the Zendesk subprocessor list for cross-border exposure - assess each Zendesk app or integration as a separate data processing relationship - check whether AI-powered Zendesk features (Zendesk AI, intelligent triage, suggested replies) route data to additional subprocessors or AI model providers ## Configuring Zendesk for GDPR Compliance A GDPR compliance approach for Zendesk should address the following: 1. **Sign the Zendesk DPA.** Confirm the DPA is in place and covers your plan, data categories, and subprocessors. 2. **Confirm data residency.** If EU-only residency is a requirement, verify that your plan and account configuration routes ticket data to EU data centers. Get this confirmation from Zendesk in writing. 3. **Review retention settings.** Configure ticket retention policies to match your GDPR retention obligations. Zendesk allows configuration of automatic ticket deletion, but defaults may retain data longer than necessary. Review data deletion practices for closed and resolved tickets. 4. **Manage deletion requests.** Under GDPR, customers have the right to erasure (Article 17 GDPR). Zendesk provides tools for deleting customer records and anonymizing ticket data. Ensure you have a documented process for handling deletion requests, including data in attachments and exports. 5. **Configure privacy notices.** Your privacy policy must inform customers about Zendesk as a data processor, the categories of data processed, and the transfer setup. If using Zendesk Chat or a customer-facing bot, ensure appropriate notice is provided before data collection begins. 6. **Assess agent analytics and monitoring.** Zendesk surfaces detailed metrics about agent activity — response times, handle times, CSAT scores, and ticket volume. In Germany, this data constitutes **employee monitoring** for GDPR and labor law purposes (see below). 7. **Update your records of processing activities.** Document Zendesk as a processing activity in your **Article 30 GDPR records**, including data categories, processor relationship, transfer setup, and retention periods. For Zendesk deployments integrated with automation tools like [Zapier](https://compound.law/en-DE/tools/zapier/) or [Make.com](https://compound.law/en-DE/tools/make/), the combined workflow creates additional data flows that must be assessed together rather than in isolation. ## Zendesk Advanced Compliance and CSAT Data Zendesk offers **Advanced Compliance** as an optional add-on for enterprise customers. Relevant capabilities include: - enhanced data encryption and key management - granular data retention and deletion policies - audit logging for administrative actions - additional controls for regulated industries (healthcare, financial services) For German companies in regulated sectors — health insurance, banking, legal services — Advanced Compliance substantially reduces the gap between standard Zendesk configuration and the compliance posture required for sensitive customer data. **CSAT data** deserves particular attention. Customer satisfaction surveys and ratings are directly linked to individual tickets and agents. They constitute personal data of both customers (their opinion and service experience) and employees (their performance as reflected in ratings). Managing CSAT data under GDPR requires: - a legal basis for processing customer satisfaction data (typically legitimate interests) - transparency to customers about how CSAT data is used - appropriate retention limits - caution about how CSAT data is used in employee performance evaluations — which raises labor law considerations ## Works Council and Agent Monitoring Risks German companies frequently underestimate the labor law dimension of Zendesk deployments. Zendesk generates detailed **agent performance data** — response times, first reply times, ticket handle times, customer satisfaction scores, and resolution rates. Even if no one is actively using this data to evaluate employees, the **technical capability to monitor individual agent performance** can trigger co-determination rights under **section 87(1) no. 6 BetrVG**. Specific Zendesk features that may require Betriebsrat review: - **Explore analytics dashboards** showing individual agent metrics - **CSAT reports** broken down by agent - **Queue and capacity reporting** showing individual workload and response patterns - **Zendesk AI features** that evaluate or score agent responses - **Quality Assurance (QA) integrations** that score agent conversations automatically This does not mean these features cannot be used. It means that in Germany, deploying or expanding Zendesk in ways that enable monitoring of individual agent behavior should involve works council consultation, a clear internal policy on how performance data is used, and ideally a **Betriebsvereinbarung** (works agreement) that defines acceptable analytics practices. ## When to Involve Legal Counsel You should seek specific advice when your Zendesk deployment: - handles **health-related, financial, or other sensitive customer data** through support tickets - uses **Zendesk AI features** to triage, suggest, or automate responses involving personal data - involves **large-scale customer data** or processing for profiling purposes - is being used in **regulated sectors** — insurance, healthcare, financial services, legal services - raises **employee monitoring questions** through agent analytics or QA tools that require works council negotiation At that point, the question is not whether Zendesk supports GDPR compliance as a platform. It is whether your specific implementation, your DPA, your data residency configuration, and your internal practices are defensible under German data protection law. Compound Law advises businesses and founders in Germany on **GDPR, employment law, commercial contracts, and AI compliance**. If you want to review a Zendesk DPA, assess your ticket data practices, or prepare a Betriebsvereinbarung for customer service software, [contact us](https://compound.law/en-DE/#booking). ## FAQ: Zendesk and German Data Protection Law ### Is Zendesk GDPR compliant for companies in Germany? Zendesk can support GDPR-compliant use, but the platform does not make your deployment automatically compliant. The DPA, data residency configuration, subprocessors, ticket content management, and agent analytics practices all need to be assessed for your specific implementation. ### Does Zendesk have a DPA for GDPR? Yes, Zendesk provides a Data Processing Agreement addressing Article 28 GDPR requirements. Companies should sign it and review the subprocessors, transfer language, deletion terms, and data residency configuration specific to their plan and use case. ### Where does Zendesk store data for EU customers? Standard plans process data in the United States, covered by Standard Contractual Clauses. EU data residency is available for qualifying enterprise plans and must be explicitly configured. Companies should confirm their specific data residency setup with Zendesk in writing. ### Do German companies need works council approval for Zendesk? In most German companies deploying Zendesk with agent analytics enabled, yes. Agent performance metrics, CSAT reporting, and QA tools create individual monitoring capability that triggers co-determination rights under section 87(1) no. 6 BetrVG. Early works council involvement is advisable. ### Can Zendesk be used for sensitive customer data? It depends on the data category, configuration, and plan. For health-related, financial, or special category data flowing through support tickets, a deeper GDPR review and potentially Zendesk Advanced Compliance controls are needed. Standard Zendesk configurations are not designed to handle special category data without additional safeguards. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Yes, Zendesk provides a Data Processing Agreement (DPA) that addresses Article 28 GDPR requirements for processor relationships. Companies should sign it and review the subprocessors, EU data residency configuration, transfer mechanisms, and deletion terms relevant to their plan and use case. Zendesk can support GDPR-compliant use in Germany, but compliance depends on the specific plan, DPA, data residency settings, subprocessors, data categories in ticket content, and how agent analytics features are configured and used. Standard Zendesk plans process data in the United States. EU data residency — where ticket and customer data is stored and processed within the EU — is available for qualifying enterprise plans. Companies with hard residency requirements should confirm their specific plan and configuration. The main risk is treating Zendesk as a standard SaaS tool and not reviewing what personal data ticket content, chat logs, and attached files contain. Sensitive customer data, health-related support tickets, and broad agent activity analytics all raise GDPR compliance questions that go beyond a basic DPA review. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Is Zendesk GDPR Compliant in Germany? Yes — With DPA and EU Residency", "description": "Yes — Zendesk can be GDPR-compliant in Germany: signed DPA, EU data residency on qualifying enterprise plans, and works council checks for agent analytics.", "image": "https://compound.law/assets/images/tools/tools_2.webp", "datePublished": "2026-04-06T00:00:00.000Z", "dateModified": "2026-04-06T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/zendesk/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Is Zendesk GDPR Compliant in Germany? Yes — With DPA and EU Residency", "item": "https://compound.law/en-DE/tools/zendesk/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does Zendesk have a Data Processing Agreement (DPA) for GDPR?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, Zendesk provides a Data Processing Agreement (DPA) that addresses Article 28 GDPR requirements for processor relationships. Companies should sign it and review the subprocessors, EU data residency configuration, transfer mechanisms, and deletion terms relevant to their plan and use case." } }, { "@type": "Question", "name": "Is Zendesk GDPR compliant for companies in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "Zendesk can support GDPR-compliant use in Germany, but compliance depends on the specific plan, DPA, data residency settings, subprocessors, data categories in ticket content, and how agent analytics features are configured and used." } }, { "@type": "Question", "name": "Where does Zendesk store customer data for EU customers?", "acceptedAnswer": { "@type": "Answer", "text": "Standard Zendesk plans process data in the United States. EU data residency — where ticket and customer data is stored and processed within the EU — is available for qualifying enterprise plans. Companies with hard residency requirements should confirm their specific plan and configuration." } }, { "@type": "Question", "name": "What is the main GDPR risk when using Zendesk?", "acceptedAnswer": { "@type": "Answer", "text": "The main risk is treating Zendesk as a standard SaaS tool and not reviewing what personal data ticket content, chat logs, and attached files contain. Sensitive customer data, health-related support tickets, and broad agent activity analytics all raise GDPR compliance questions that go beyond a basic DPA review." } } ] } ] ```