Perplexity compliance: GDPR, AI Act, DPA, training, transfers

TL;DR. Four distinct products: Enterprise Pro / Enterprise Max (contractually no training on customer content; files attached to sessions deleted after seven days; no customer zero data retention option published); the Perplexity API (no training under the API Terms; zero data retention only for eligible customers under a written agreement); consumer Free / Pro / Max (data collected for AI training by default unless the user opts out); Comet (agentic browser, with its browser functionality under separate terms and a much larger data-collection surface). Perplexity routes some workloads to third-party models (OpenAI, Anthropic, Google and xAI) alongside its own Sonar models, and its Enterprise and API terms require the customer to comply with the terms of each third-party model it uses. Search query strings can themselves be Article 9 data where they reveal health or another category listed in Article 9(1), so a DPIA should treat the query string as a data flow. Both the Enterprise and the API terms prohibit PHI unless a BAA has been executed. The clause already appears in the Enterprise Terms version dated 23 May 2025 and in the API Terms version dated 23 January 2026.

DPO action: distinguish surfaces in your AI inventory; record which third-party models staff and integrations can reach, because the customer agrees to their terms; treat Comet as a separate vendor evaluation; execute a BAA before any PHI and confirm in writing which products and models it covers.

What the tool does

Perplexity is an AI-powered answer engine. Instead of returning a list of links like a search engine, it crawls the web and synthesises a sourced answer. Buyers commonly evaluate one of four products:

1. Perplexity (Free / Pro / Max consumer) - at perplexity.ai, individual subscriptions
2. Perplexity Enterprise Pro / Enterprise Max - business-tier with admin controls and stronger compliance defaults
3. Perplexity API (Sonar models and the Agent API) - Perplexity's developer platform for embedding answer-engine functionality into other products
4. Comet - Perplexity's agentic browser (separate product, separate compliance posture)

Compliance posture differs across these surfaces. Most enterprise buyers should be looking at Enterprise Pro, Enterprise Max or the API, not the consumer tier.

Data processed

• Search queries (which often contain context that is itself personal data)
• Documents uploaded for Q&A (Pro / Enterprise feature)
• Conversation history
• Files uploaded for analysis
• For Comet (browser): browsing history, page content, account credentials if sign-ins are stored

Special-category likelihood: Medium-high. Search queries can reveal information about the person asking or about other people. A query is special-category data under Article 9(1) GDPR only where it reveals one of the categories listed there, such as health: a question about a named patient's diagnosis would be, and a query such as "side effects of [drug] when pregnant" would be where it reveals the health of the person asking or of another identifiable person. Free-form team usage can produce such queries, so the DPIA should cover what staff type into the query box.

Default geographic processing: US. Perplexity does not publish an EU data residency option, and every subprocessor on its list is located in the US (checked 15 October 2026).

DPA availability

Perplexity publishes a Data Processing Addendum, last updated 13 August 2026.

• URL: https://www.perplexity.ai/hub/legal/dpa
• The DPA is incorporated by reference into the Perplexity Enterprise Terms and Conditions (s 5.1, last updated 3 August 2026) and the Perplexity API Terms of Service (s 6.1, last updated 23 January 2026)
• Auto-incorporation model - by accepting the Enterprise or API terms, the customer accepts the DPA
• Product-specific terms take precedence for some services. The DPA states that "Certain Services (including but not limited to the Embeddings API and Perplexity Search) may operate under data postures that differ from this DPA", and for those services the product-specific terms govern
• New subprocessors other than model providers: ten business days' prior notice, a right to object on reasonable, documented grounds within five business days, and, if no resolution is found, termination with a refund of prepaid unused fees as the customer's sole remedy
• New model providers: Perplexity notifies the customer and updates its third-party models list, and if the customer objects, its "sole recourse is to cease all use of the relevant Third-Party Model via the Services"

Consumer plans (Free, Pro and Max) do NOT auto-incorporate the DPA in the same way. Consumer use falls under the standard consumer Terms with weaker processor commitments.

Subprocessor list

Perplexity publishes its subprocessor list at https://trust.perplexity.ai/subprocessors (also rendered inline on the trust portal landing page). The list had 23 entries on 15 October 2026, all located in the US. They include the infrastructure providers Amazon Web Services and Microsoft Azure, and the model providers Anthropic, OpenAI, xAI, Google Cloud (described as covering AI models such as Gemini) and Amazon Bedrock.

Notable architecture (which determines transitive subprocessing):

• Sonar models: Perplexity's first-party fine-tuned Llama derivatives running on Perplexity's own retrieval pipeline. No external LLM provider in the path.
• Agent API - provides access to models from Anthropic, OpenAI, Google, xAI, Z.AI, Moonshot AI and NVIDIA as well as Perplexity's own, through what Perplexity calls "a unified interface to models from multiple providers".
• Infrastructure: Amazon Web Services (cloud infrastructure and security) and Microsoft Azure (cloud computing services) are on the subprocessor list, which does not identify either as the primary provider. Perplexity's security page describes "separate AWS accounts" for separating its environments.
• Various analytics and support tooling

Under both the Enterprise Terms (s 1.6) and the API Terms (s 2.6), a customer agrees to comply with the terms of each third-party model it uses. Perplexity's third-party models page lists OpenAI, Anthropic, Google and xAI models, and states that a plan, query and settings may use "some, all or none" of them. Using only Sonar keeps model processing with Perplexity, although Perplexity lists Meta's Llama 3.1 licence and use policy as the third-party terms for Sonar. Confirm which models your plan and integration can reach.

Training-on-customer-data position

Enterprise Pro and Enterprise Max: Perplexity's Enterprise Terms (s 1.3.3) prohibit it from using customer content to train or improve generative AI models. Perplexity also states that "Strict Zero Data Retention and Zero Data Training agreements with AI providers (OpenAI, Anthropic, and more) prevent training on Enterprise data". That describes Perplexity's agreements with its model providers, not a retention setting the customer controls. Within Perplexity, files attached to sessions are deleted after seven days, organisations with 50 or more seats or an Enterprise Max seat can set session retention periods, and admins can enforce incognito mode, under which threads are kept for 24 hours.

API: no training on customer content (API Terms s 2.3.3). Zero data retention is not on by default. Eligible customers can have it configured under a written agreement, and on the Agent API it then limits the choice to models whose providers support it.

Free, Pro and Max consumer plans: AI data retention, under which data is collected for AI training, is on by default, and the user can turn it off in account settings. An opt-out applies only to data collected after it is made. This is the same trap as ChatGPT consumer and consumer Gemini - staff using personal Pro accounts are in a training-eligible flow unless they've actively opted out.

API log retention: Perplexity does not publish a default retention period for API requests. Its API documentation states that "Retention, use, and security practices vary by API, model, and account configuration", and that some model providers "require limited retention as a condition of offering their models".

Enterprise and API defaults are strong and on par with Anthropic / OpenAI enterprise tiers. Consumer-tier shadow use is the dominant unmanaged risk for any organisation with knowledge workers. - My read

EU / UK transfer position

Perplexity relies on Standard Contractual Clauses Module 2 (controller-to-processor) and Module 3 (processor-to-processor) for EU transfers via the DPA. The DPA explicitly names the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B.1.0) issued by the UK Information Commissioner for transfers subject to UK GDPR. Perplexity AI, Inc. is no longer certified under the EU-US Data Privacy Framework. When the participant registry was checked on 26 October 2026 (register file dated 25 October), its EU-US certification and its UK Extension certification were both listed as "Inactive - Withdrawal", with both periods shown as ending on 8 October 2026 (it held no Swiss-US certification). Both had been listed Active when this page checked the registry on 15 October 2026. Perplexity's privacy notice, last updated 23 October 2026, no longer refers to the framework, and it says that individuals may request a copy of "any Standard Contractual Clauses we use for the transfer of your data outside of the EEA or United Kingdom". Transfers to Perplexity therefore rest on the SCCs and the UK Addendum in the DPA, as they do for OpenAI and Anthropic, neither of which appears on the participant list. If your record of processing names the DPF as the transfer mechanism for Perplexity, update it. Because the transfer now relies on the SCCs rather than an adequacy decision, you also need a transfer impact assessment.

EU data residency: Perplexity does not publish an EU data residency option. Default processing is US-resident.

Security documentation

Per the trust portal at https://trust.perplexity.ai/ (read 2026-10-15):

• SOC 2 Type 2: yes (report available through the trust portal)
• ISO/IEC 27001:2022: yes (listed on the trust portal, with the certificate among its resources)
• ISO/IEC 27701: not displayed
• ISO/IEC 42001: not displayed. OpenAI lists ISO/IEC 42001:2023 on its trust portal
• HIPAA: listed. The Enterprise Terms (s 5.2) and API Terms (s 6.2) prohibit processing PHI unless a BAA has been executed, a clause that already appears in the Enterprise Terms version dated 23 May 2025
• GDPR / UK GDPR: yes, addressed in the DPA
• PCI DSS (SAQ A): yes
• FedRAMP 20x Low (Class B): yes, with an overview and a KSI assessment on the trust portal whose file names include "(Public)"
• Self-assessments: CAIQ Lite and VSA Core, both dated March 2026

The trust portal lists its compliance documents, including the SOC 2 Type 2 report, the ISO/IEC 27001:2022 certificate, the HIPAA gap assessment, security policies and penetration testing, and offers a "Request access" route. In the rendered page every listed document carries a lock icon, including the two FedRAMP 20x files whose names include "(Public)", and the Data Processing Addendum entry links to Perplexity's public DPA page.

HIPAA & BAA position

Perplexity's Enterprise Terms (s 5.2) and API Terms (s 6.2) both provide that the customer may not use the Services to process Protected Health Information "unless Customer and Perplexity have executed a Business Associate Agreement." The clause is not new: the same wording appears in the Enterprise Terms version of 23 May 2025. Perplexity does not publish a BAA template, so confirm with Perplexity which products and models a BAA covers before any PHI is processed. Its trust portal holds a HIPAA Security Rule gap assessment by Insight Assurance as of 1 March 2026 (its API documentation refers to a "2025 HIPAA Gap Assessment") and a CAIQ Lite self-assessment dated March 2026.

• Not eligible: the consumer Free, Pro and Max plans, which follow Perplexity's consumer data policy rather than the Enterprise or API terms. Comet's browser functionality is governed by separate browser terms that "form a separate agreement between Customer and Perplexity", so confirm separately whether a BAA extends to Comet before any PHI.
• The query string is the under-counted exposure. Perplexity's input is a search query, and in healthcare a query is often PHI in itself ("treatment options for [name]'s [condition]"). The BAA covers the contract. The operational control is a rule on what staff may enter in the query box.
• The multi-model question (Perplexity-specific). If you use the Agent API, each query goes to the model selected. Anthropic, OpenAI, Google and xAI are on Perplexity's subprocessor list. The Z.AI, Moonshot AI and NVIDIA models carry perplexity/ model IDs, and none of those three companies is on the subprocessor list, so confirm with Perplexity where they are hosted. Perplexity's documents differ on whether model providers are its subcontractors: the DPA treats a provider of generative AI models as a subcontractor (a "Model Provider"), while the Enterprise Terms describe third-party providers as "not an agent, partner, or subcontractor of Perplexity for purposes of this Agreement". For PHI, either stay on the first-party Sonar path or confirm in writing which models and providers the BAA covers.

The BAA is the contractual piece. HIPAA's Security Rule (risk analysis, minimum-necessary, workforce training, audit controls, breach notification) still falls on the covered entity. See HIPAA for AI tools for the full walkthrough across vendors.

AI Act role + risk classification

• Role: Perplexity is the provider of its answer engine, an AI system it places on the market under its own name (Article 3(3)). Because that system integrates AI models, its own Sonar models and third-party models such as those of OpenAI, Anthropic, Google and xAI, Perplexity is also a downstream provider, which the Act defines as "a provider of an AI system, including a general-purpose AI system, which integrates an AI model, regardless of whether the AI model is provided by themselves and vertically integrated or provided by another entity based on contractual relations" (Article 3(68)). The makers of the third-party models carry the obligations of general-purpose AI model providers for those models.
• Your role as a buyer: deployer of an AI system, with deployer obligations. A buyer that builds its own AI system on the Perplexity API and places it on the market or puts it into service under its own name is the provider of that system (Article 3(3)).
• Risk tier: typical search / information-retrieval use falls at minimal or limited risk. Annex III applicability depends on what answers are being relied on for. If Perplexity is used in an Annex III process, such as HR screening, the deployer obligations in Article 26 apply from 2 December 2027 (a fixed date set by Article 113 as amended by Regulation (EU) 2026/1744) unless the Article 6(3) exception applies (a system that profiles natural persons is always high-risk), and the buyer should assess whether it has become the provider of a high-risk system under Article 25(1)(c).

DPIA prompts (for your use case)

1. Which Perplexity surface are staff using? Free, Pro, Max, Enterprise Pro, Enterprise Max, the API, or Comet - each has a different compliance posture. Don't accept "we use Perplexity" as a sufficient inventory entry.
2. Are search queries themselves a privacy concern for your sector? Legal, healthcare, HR, compliance teams - query strings often expose case-level detail that the buyer didn't realise was being transmitted.
3. Is the underlying LLM stack acceptable to you? Perplexity routes through multiple model providers depending on plan and feature. Its DPA treats model providers as subcontractors, while the Enterprise Terms (s 1.6) state that third-party providers are not its subcontractors for the purposes of that agreement. Both the Enterprise and API terms require you to comply with each third-party model's terms.
4. Comet browser specifically: if any staff use Comet, you have a much larger data-collection surface (full browsing history, page content) than the answer-engine product. Treat Comet as a separate vendor evaluation.
5. AI Act Annex III applicability: is the answer engine being used as decision-support in any Annex III process? If yes, the high-risk deployer obligations apply from 2 December 2027 unless the Article 6(3) exception applies, and you should assess whether the use has made you the provider under Article 25(1)(c).

Unresolved questions / red flags

• Multi-model dependency. Through the Agent API, a buyer's data goes to the model selected. Anthropic, OpenAI, Google and xAI are on Perplexity's subprocessor list. The Z.AI, Moonshot AI and NVIDIA models carry perplexity/ model IDs, and none of those three companies is on the subprocessor list, so confirm with Perplexity where they are hosted. Under the Enterprise and API terms the customer agrees to comply with the third-party terms of the models it uses. Confirm which models your plan and integration can reach.
• No ISO/IEC 42001 or ISO/IEC 27701 certification is displayed. Perplexity lists SOC 2 Type 2, ISO/IEC 27001:2022 and FedRAMP 20x Low. Raise ISO/IEC 27701 and 42001 with Perplexity for any procurement that requires them.
• Comet is a separate compliance surface from the answer engine. Perplexity offers it to Enterprise customers under Comet-specific terms, and its browser functionality is governed by separate browser terms that form a separate agreement with Perplexity.
• Search query content can itself be Article 9 data where a query reveals health or another category listed in Article 9(1), so the DPIA should treat the query string as a data flow in its own right.
• EU data residency: Perplexity does not publish an EU data residency option, and every subprocessor on its list is located in the US (checked 15 October 2026).
• Public subprocessor list URL has shifted historically - flag if not findable.

Related profiles

• OpenAI - third-party model provider and Perplexity subprocessor; customers agree to comply with its terms when they use its models through Perplexity
• Anthropic - third-party model provider and Perplexity subprocessor; customers agree to comply with its terms when they use its models through Perplexity

Sources checked

• https://www.perplexity.ai/hub/legal/dpa - Data Processing Addendum, last updated 13 August 2026 (transfer clauses, UK Addendum version, subprocessor notice, product-specific carve-outs), compared with the 7 July 2026 archived copy - checked 2026-10-15
• https://www.perplexity.ai/hub/legal/enterprise-terms-of-service - Enterprise Terms and Conditions, last updated 3 August 2026 (ss 1.3.3, 1.6, 5.1 and 5.2), compared with the archived versions of 23 May 2025 and 6 February 2026 - checked 2026-10-15
• https://www.perplexity.ai/hub/legal/perplexity-api-terms-of-service - API Terms of Service, last updated 23 January 2026 (ss 2.3.3, 2.6, 6.1 and 6.2) - checked 2026-10-15
• https://www.perplexity.ai/hub/legal/enterprise-comet-specific-terms - Comet-specific terms (browser functionality under separate terms) - checked 2026-10-15
• https://www.perplexity.ai/hub/legal/third-party-models - third-party models and terms, last updated 25 November 2025 - checked 2026-10-15
• https://www.perplexity.ai/hub/legal/privacy-notice (the former privacy-policy address redirects here) - privacy notice, last updated 23 October 2026 (no DPF statement; Standard Contractual Clauses for transfers outside the EEA or UK) - checked 2026-10-26. The previous notice, last updated 8 July 2026, stated compliance with the DPF and the UK Extension - checked 2026-10-15
• https://trust.perplexity.ai/ - trust portal certifications, HIPAA gap assessment and self-assessments - checked 2026-10-15
• https://trust.perplexity.ai/subprocessors - subprocessor list (23 entries, all US) - checked 2026-10-15
• https://intercom.help/perplexity-ai/en/articles/11564572-data-collection-at-perplexity - training and retention for consumer and Enterprise plans - checked 2026-10-15
• https://www.perplexity.ai/help-center/en/articles/11652701-data-retention-for-enterprise - Enterprise file and session retention - checked 2026-10-15
• https://intercom.help/perplexity-ai/en/articles/10517443-enterprise-security-hub-settings - incognito mode retention - checked 2026-10-15
• https://docs.perplexity.ai/docs/resources/privacy-security - API privacy, zero data retention and certifications - checked 2026-10-15
• https://docs.perplexity.ai/docs/agent-api/models - Agent API model providers - checked 2026-10-15
• https://www.perplexity.ai/enterprise and https://www.perplexity.ai/enterprise/security - Enterprise product and security pages - checked 2026-10-15
• dataprivacyframework.gov participant registry (Perplexity AI, Inc., OrganizationId 9020: EU-US and UK Extension "Inactive - Withdrawal", periods ending 8 October 2026, register file dated 25 October 2026; Microsoft control Active) - checked 2026-10-26. On 15 October 2026 both Perplexity certifications were listed Active, and OpenAI and Anthropic were not listed
• Regulation (EU) 2024/1689 (the AI Act), Articles 3, 6, 25 and 26 and Annex III, and Regulation (EU) 2026/1744 (the Digital Omnibus on AI), amending Article 25(2) and (4) and setting 2 December 2027 for Annex III high-risk systems in Article 113, both from the Publications Office (https://publications.europa.eu/resource/celex/32024R1689 and https://publications.europa.eu/resource/celex/32026R1744) - checked 2026-10-15

Related reading

• DPA for AI vendors - the eight clauses to check on any AI vendor DPA, applied to Perplexity Enterprise
• EU AI Act for AI buyers - deployer-side obligations for Perplexity deployments
• HIPAA for AI tools - the BAA position for Perplexity Enterprise vs the hyperscaler alternatives
• Perplexity vs ChatGPT for regulated industries - the citation-evidence-trail advantage for research workflows

For ongoing AI compliance support, work with Janus DPO-as-a-Service. For other vendors, browse the full index, or see real agent failures analysed legally in the AI Agent Incident Register.