--- title: "Zoom AI Companion GDPR Compliance for German Businesses" description: "Is Zoom AI Companion GDPR compliant in Germany? Review Zoom's DPA, AI processing, EU data residency, and the checklist for German businesses." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/zoom/" language: "en" --- ![Zoom AI Companion GDPR compliance for German businesses](https://compound.law/assets/images/tools/tools_4.webp) tools # Zoom AI Companion GDPR Compliance for German Businesses 22 May 2026 Is Zoom AI Companion GDPR compliant in Germany? Zoom AI Companion can be deployed in a GDPR-compliant way in Germany, but only if your company accepts Zoom's DPA, verifies EU data residency for the AI features you enable, sets a lawful basis for employee and participant data, and handles works-council co-determination where monitoring risks exist. - Zoom can be configured compliantly, but AI Companion needs a stricter review than core video meetings. - The key 2026 checks are the DPA version, AI inference location, and the exact scope of EU data residency. - Frankfurt hosting alone is not enough if AI processing, support access, or external transfers still fall outside your approved setup. **Yes, Zoom AI Companion can be used in a GDPR-compliant way in Germany, but only with additional legal and technical checks beyond standard Zoom meetings.** For most German businesses, the decisive points are whether you have accepted Zoom’s current **DPA**, whether **AI Companion** stays within your approved data-flow design, whether the **EU data residency** add-on actually covers the AI features you want, and whether **works-council co-determination** is required before employee rollout. Our [AI tools compliance overview](https://compound.law/en-DE/tools/) covers other enterprise AI tools assessed for use in Germany. ## Short answer: Is Zoom AI Companion GDPR compliant in Germany? The short answer is **yes, conditionally**. Zoom’s core conferencing product and Zoom AI Companion are not the same compliance question. A company may have a defensible Zoom setup for video meetings while still needing a separate approval process for AI meeting summaries, smart recordings, transcripts, and chat assistance. For German companies, the fastest decision test is: - **Contract layer:** accept Zoom’s DPA and confirm the current version in your vendor file - **Transfer layer:** check whether your selected data residency setup also covers the AI feature you plan to enable - **Employment layer:** assess **§26 BDSG** and **§87(1) No. 6 BetrVG** before enabling AI Companion for employees - **Meeting layer:** ensure participants are informed when AI summaries, transcripts, or smart recording functions are active If one of those layers is unresolved, the safer conclusion is not “Zoom is non-compliant,” but rather “AI Companion is not yet approved for this use case.” ## What German businesses should verify in 2026 As of **May 22, 2026**, three product-specific checks matter most for German buyers and privacy teams: 1. **Which DPA version is on file?** Zoom’s public **Global Data Processing Addendum** was updated in **November 2024**. Your procurement file should record the accepted version, date, account entity, and any negotiated addenda. 2. **Where does AI Companion processing happen for your setup?** Zoom’s **AI Companion privacy and security whitepaper** updated on **August 26, 2025** states that Zoom AI Companion may use **Zoom-hosted models** and, depending on feature and configuration, third-party model providers. That makes the inference location and transfer design a live review point, not a box you can assume from core Zoom hosting alone. 3. **What does EU data residency actually cover?** Zoom’s **April 2026 EU infrastructure fact sheet** says eligible EU-hosted customers can use AI Companion with **in-region processing** and a **Zoom-hosted Models Only** option, but you still need to confirm the scope for your plan, activated features, support paths, and cross-region meeting scenarios. This is why the right legal answer for many organisations is not “Is Zoom compliant?” but “Is our intended **Zoom AI Companion configuration** compliant?” ## Zoom’s Data Processing Agreement (DPA) Zoom’s DPA is the contractual starting point for any German business that wants to use Zoom for employee or customer data. It is not enough on its own, but without it the rest of the analysis usually stops. For practical review purposes, confirm that your file covers: - **Article 28 GDPR processor terms** - **Standard Contractual Clauses (SCCs)** for restricted transfers - **Sub-processor change management** - **Security and confidentiality obligations** - **Deletion, return, audit, and assistance obligations** This DPA review matters even more for AI Companion because summaries, transcripts, smart recordings, and AI chat functions can process richer meeting content than standard call metadata. **What Zoom’s DPA includes:** - Controller-processor relationship, with Zoom acting as processor for customer data - Standard Contractual Clauses (SCCs) covering transfers of personal data outside the EEA - Data security and confidentiality obligations (GDPR Art. 32) - Sub-processor management with prior notice of changes - Rights to conduct audits and inspections - Obligations to assist with data subject rights requests - Data deletion and return commitments at contract termination **How to access Zoom’s DPA:** Zoom’s Global Data Processing Addendum is available through Zoom’s legal documentation and admin flows. Enterprise contracts may also contain negotiated addenda. For German procurement files, keep a copy of the accepted DPA version, the acceptance date, and any deviations from Zoom’s standard terms. For a detailed guide to reviewing AI tool DPAs, see our [data processing agreement guidance](https://compound.law/en-DE/compliance/data-processing-agreement/). ## Zoom AI Companion and GDPR Zoom AI Companion is Zoom’s suite of AI-powered features, including: - **AI Meeting Summaries:** Automatically generated summaries of meeting content and decisions - **Smart Recording:** AI-generated chapters, transcripts, and highlights from recorded meetings - **AI Companion Chat:** AI-assisted responses and suggestions in Zoom Chat - **AI Notes:** Real-time note suggestions during live meetings Each of these features processes personal data — the content of meetings, names and voices of participants, written chat, and conversation metadata. This creates specific GDPR obligations that extend significantly beyond standard video conferencing compliance. ### What data does Zoom AI Companion process? Zoom AI Companion processes the following categories of personal data: - **Meeting audio and video content** — transcribed for summaries and smart recordings - **Chat messages** — accessed by the AI Companion for context-aware responses - **Participant identifiers** — names, email addresses, associated with AI outputs - **Behavioural metadata** — attendance patterns, participation data used by AI features Depending on what participants discuss, meeting audio and transcripts may indirectly reveal health information, trade union membership, political opinions, or other **special category data** under GDPR Art. 9. This creates a heightened compliance obligation even when AI Companion is used for ordinary business meetings. ### Legal basis for Zoom AI Companion under GDPR Before enabling Zoom AI Companion, your organisation must identify a valid legal basis under **GDPR Art. 6**: **Legitimate interest (Art. 6(1)(f)):** Often applied for internal productivity tools, but requires a balancing test against employees’ and participants’ privacy rights. For German companies, processing employee data on the basis of legitimate interest must also satisfy **§26 BDSG** (Federal Data Protection Act). **Contract performance (Art. 6(1)(b)):** Generally not suitable as the primary basis for AI meeting recording or employee monitoring. **Consent (Art. 6(1)(a)):** Valid for processing data from external meeting participants, but difficult to use for employee data due to the inherent power imbalance. Employer-collected consent from employees may not be freely given and therefore invalid under GDPR. German companies should assess the appropriate legal basis for each AI Companion feature separately, and for each category of data subject (employees versus external participants). ### Opt-in and opt-out configuration Zoom AI Companion features are configurable at account, group, or user level through the Zoom Admin Console: - **Account-level control:** Administrators can enable or disable AI Companion features globally before any user activates them - **Meeting host control:** Hosts can toggle specific AI features per meeting - **Participant notification:** Zoom displays an AI Companion indicator when features are active — participants are notified automatically For GDPR compliance, verify that participant notification is enabled and that employees receive clear information about when AI features are processing their speech and contributions. For [AI transcription compliance under GDPR](https://compound.law/en-DE/compliance/ai-transcription/), our dedicated guide explains the obligations triggered by automatic transcription of meetings. ## Data Residency: Where Does Zoom Store Your Data? By default, Zoom routes data through its global infrastructure, which includes US-based data centres. For German businesses, this creates transfer obligations under GDPR Chapter V (international data transfers). **EU Data Residency option:** Zoom offers an **EU Data Residency** configuration for enterprise customers. With this enabled: - Data at rest is stored in European data centres, including Frankfurt - Real-time meeting data is routed through EU infrastructure - SCCs in Zoom’s DPA cover any residual transfers outside the EEA **Important limitations to verify:** - EU Data Residency is typically an add-on feature for enterprise accounts — not included in standard licences - Not all data types may fall within the residency scope — review exactly which data categories are covered - AI model inference for Zoom AI Companion features may involve cloud-based processing that operates differently from at-rest data residency - Support access from non-EU Zoom personnel may create residual transfer exposure under your DPA In practice, this means **Frankfurt hosting alone is not a complete AI Companion answer**. Your privacy team should ask Zoom or your reseller to confirm, in writing, whether the AI features you intend to enable remain within your approved residency and model-processing scope. German companies in regulated sectors — financial services, healthcare, or legal — should verify the full residency scope before treating the EU Data Residency option as a complete transfer solution. ## Zoom GDPR Risk Checklist for German Businesses Work through this checklist before or during your Zoom deployment: **DPA and legal framework:** - [ ] Accept Zoom’s Data Processing Addendum through your account admin portal - [ ] Verify the DPA version and effective date in writing - [ ] Confirm Zoom’s role as processor (not controller) for meeting content - [ ] Review SCCs for US-based data transfers - [ ] Add Zoom to your data processing register (*Verzeichnis der Verarbeitungstätigkeiten*) **AI Companion specific:** - [ ] Decide at account level whether Zoom AI Companion is enabled for your organisation - [ ] Establish the legal basis for AI Companion under GDPR Art. 6 (and §26 BDSG for employee data) - [ ] Configure participant notification — confirm the AI indicator is displayed in meetings - [ ] Assess whether a Data Protection Impact Assessment (DPIA) is required under GDPR Art. 35 - [ ] Document your AI Companion configuration decisions with written rationale **Data residency:** - [ ] Determine whether the EU Data Residency add-on is required for your compliance posture - [ ] Verify which specific data types are covered by EU residency configuration - [ ] Review AI model inference locations for AI Companion features with your Zoom account manager **Works council (Betriebsrat):** - [ ] Assess whether Zoom AI Companion triggers co-determination rights under §87 BetrVG - [ ] If applicable, initiate works council consultation before enabling AI Companion for employees - [ ] Document the outcome and any agreed works agreement (*Betriebsvereinbarung*) **Employee communication:** - [ ] Update employee privacy notices to cover Zoom AI Companion data processing - [ ] Train employees on when AI features are active and how to identify them - [ ] Establish an internal policy on acceptable use and storage of AI Companion outputs ## Works Council Requirements in Germany German companies with a works council (**Betriebsrat**) must assess whether Zoom AI Companion triggers co-determination rights under **§87(1) No. 6 BetrVG** — which covers the introduction and use of technical equipment designed to monitor employee behaviour or performance. AI meeting summaries, smart recordings, and participation analytics can constitute monitoring under this provision, even if that is not their primary purpose. The critical legal question is whether the tool creates the *possibility* of monitoring — not whether management actually intends to use it that way. **Practical implications:** - Consult your Betriebsrat before enabling AI Companion features for employees - A works agreement (*Betriebsvereinbarung*) covering Zoom AI Companion is the most defensible approach - The works agreement should specify: which features are enabled, how outputs are stored and accessed, who can review AI-generated summaries, and how long data is retained - Failing to engage the Betriebsrat may give employees grounds to demand deactivation of the features For the full framework governing [AI employee monitoring compliance](https://compound.law/en-DE/compliance/ai-employee-monitoring/) in Germany, our dedicated guide covers BetrVG co-determination requirements for AI tools in the workplace. ## How to Sign Zoom’s DPA as a German Company Follow these steps to execute Zoom’s Data Processing Addendum: 1. **Log in to your Zoom account portal** as account administrator at zoom.us 2. **Navigate to Privacy settings** — typically under Account Management → Privacy 3. **Locate the Data Processing Addendum** — for enterprise accounts this may be pre-accepted or require explicit opt-in 4. **Review the DPA** carefully, including the SCCs and sub-processor annex, before accepting 5. **Accept the DPA** through the portal, or request a countersigned addendum from your Zoom account manager for enterprise-level agreements 6. **Document the acceptance** — record who accepted, when, and which account configuration was in place 7. **Update your vendor register** — add Zoom as a data processor in your GDPR Records of Processing Activities with reference to the accepted DPA Enterprise customers with specific residency or security requirements can negotiate bespoke DPA terms through Zoom’s enterprise sales team. ## How Compound Law Helps - DPA review and gap analysis for your specific Zoom deployment - Legal basis assessment for Zoom AI Companion under GDPR Art. 6 and §26 BDSG - Works council coordination and *Betriebsvereinbarung* drafting - Data Protection Impact Assessment (DPIA) support for AI Companion features - Internal Zoom AI usage policy development - Comparison with [Microsoft Teams Copilot](https://compound.law/en-DE/tools/teams-copilot/) and [Notion AI](https://compound.law/en-DE/tools/notion-ai/) for enterprise AI tool selection ## Frequently Asked Questions ### Is Zoom AI Companion GDPR compliant? Zoom AI Companion can be used in a GDPR-compliant way, but compliance depends on your configuration, legal basis, and organisational measures — not on the tool itself. You must accept Zoom’s DPA, establish a valid legal basis for AI processing of employee and participant data, enable participant notification, and engage your works council where required. The tool is not automatically compliant simply because Zoom provides a DPA. ### Does Zoom store data in Germany? Zoom offers an EU Data Residency option that includes storage in European data centres, including Frankfurt. This is an enterprise add-on feature and is not enabled by default. AI Companion features may involve additional processing infrastructure beyond at-rest data storage — verify the full scope of data residency for AI features specifically in your DPA and account configuration. ### Is Frankfurt hosting alone enough for Zoom AI Companion? No. Frankfurt or EU hosting helps, but it does not answer every GDPR question for AI Companion. German businesses still need to verify model inference scope, support access, cross-border transfers, retention settings, participant transparency, and the intended internal use of summaries or transcripts. ### Do external meeting participants require additional Zoom AI Companion steps? Usually yes. External participants are not covered by your employee policies, so meeting notices, host controls, legal basis analysis, and the decision to activate transcripts, summaries, or smart recording features should be assessed separately for mixed internal-external meetings. ### Does Zoom AI Companion require works council approval in Germany? It often requires at least a formal co-determination assessment and, in many companies, a works agreement before rollout. If AI Companion features can make employee behaviour, participation, or performance visible, **§87(1) No. 6 BetrVG** may apply even when monitoring is not the employer’s stated purpose. ### Can German companies use Zoom AI Companion under DSGVO? Yes, German companies can use Zoom AI Companion under DSGVO with appropriate preparation: an executed DPA, a documented legal basis under Art. 6 DSGVO (and §26 BDSG for employee data), works council engagement where co-determination applies, and the correct technical configuration for participant notification. Companies without a works council have more organisational flexibility but must still address the GDPR and BDSG requirements. ### What is Zoom’s DPA and where do I find it? Zoom’s Data Processing Addendum is the contractual agreement under which Zoom processes personal data as a processor on behalf of your organisation. It covers GDPR Article 28 obligations, including Standard Contractual Clauses for international data transfers. It is accessible through your Zoom account admin portal under Privacy settings, or through Zoom’s legal documentation. Enterprise customers can request a countersigned version through their account manager. ### Do I need a DPIA for Zoom AI Companion? A Data Protection Impact Assessment (DPIA) may be required if Zoom AI Companion involves systematic monitoring of employees, large-scale processing of sensitive data, or high-risk automated outputs. German companies should assess DPIA necessity under GDPR Art. 35, considering especially the monitoring dimension of AI meeting summaries and smart recording features. When the analysis is borderline, conducting a DPIA is the more defensible approach. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) - [Claude Team Plan DPA & GDPR Compliance Guide tools](https://compound.law/en-DE/tools/claude-team-gdpr/) ## Frequently asked questions It can be, but not by default. German businesses need Zoom's DPA, a documented legal basis, a review of AI data flows, participant transparency, and works-council handling where employee monitoring risks exist. No. Frankfurt or EU hosting helps with residency, but you still need to verify AI inference, support access, transfer safeguards, retention settings, and your own internal use rules. Yes. External participants create a separate transparency and legal-basis analysis. Meeting notices, host controls, and the scope of any recording, transcript, or summary feature should be reviewed for each meeting format. Often it at least requires a formal co-determination assessment. If the enabled features can make employee behaviour or performance visible, §87(1) No. 6 BetrVG can be triggered before rollout. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Zoom AI Companion GDPR Compliance for German Businesses", "description": "Is Zoom AI Companion GDPR compliant in Germany? Review Zoom's DPA, AI processing, EU data residency, and the checklist for German businesses.", "image": "https://compound.law/assets/images/tools/tools_4.webp", "datePublished": "2026-05-22T00:00:00.000Z", "dateModified": "2026-05-22T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/zoom/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Zoom AI Companion GDPR Compliance for German Businesses", "item": "https://compound.law/en-DE/tools/zoom/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is Zoom AI Companion GDPR compliant in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "It can be, but not by default. German businesses need Zoom's DPA, a documented legal basis, a review of AI data flows, participant transparency, and works-council handling where employee monitoring risks exist." } }, { "@type": "Question", "name": "Is Frankfurt hosting alone enough for Zoom GDPR compliance?", "acceptedAnswer": { "@type": "Answer", "text": "No. Frankfurt or EU hosting helps with residency, but you still need to verify AI inference, support access, transfer safeguards, retention settings, and your own internal use rules." } }, { "@type": "Question", "name": "Do external participants change the Zoom AI Companion analysis?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. External participants create a separate transparency and legal-basis analysis. Meeting notices, host controls, and the scope of any recording, transcript, or summary feature should be reviewed for each meeting format." } }, { "@type": "Question", "name": "Does Zoom AI Companion require works-council approval in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "Often it at least requires a formal co-determination assessment. If the enabled features can make employee behaviour or performance visible, §87(1) No. 6 BetrVG can be triggered before rollout." } } ] } ] ```