If you are in the EU, UK, or anywhere outside Israel or the US, your data will be transferred to and stored in Israel and the United States. AI21 says it uses Standard Contractual Clauses as the legal mechanism to protect EU user data during this transfer.
This analysis describes what AI21 Labs's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Data transferred outside the EU or UK may be subject to different legal protections, and the adequacy of Standard Contractual Clauses as a transfer mechanism depends on whether supplementary measures are in place given the privacy laws of the recipient country.
Interpretive note: The adequacy of supplementary measures accompanying SCCs for US transfers cannot be assessed from the policy text alone, and the current status of any transfer impact assessment is not disclosed.
EU, UK, and non-US users' personal data is routinely transferred to Israel and the United States, with Standard Contractual Clauses cited as the legal safeguard for EU and UK users. Israel has been recognized by the EU as providing adequate data protection under GDPR, though this adequacy status should be monitored as regulatory reviews continue.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
Your personal information may be transferred to, and maintained on, computers located outside of your state, province, country, or other governmental jurisdiction where the privacy laws may not be as protective as those in your jurisdiction.
Your personal information may be transferred to, stored, and processed in the United States or other countries outside of your country of residence, which may have data protection laws that are different from those in your country.
Monitoring
AI21 Labs has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"AI21 is headquartered in Israel and operates servers and infrastructure in the United States and other jurisdictions. If you are located outside of Israel or the United States, your personal data may be transferred to and processed in those countries. For transfers of personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.— Excerpt from AI21 Labs's AI21 Labs Privacy Policy
REGULATORY LANDSCAPE: This provision directly engages GDPR Chapter V, which governs transfers of personal data to third countries. Standard Contractual Clauses (SCCs) are a recognized transfer mechanism under GDPR Article 46. Israel has been granted EU adequacy status under GDPR, though this status is subject to periodic review. Transfers to the United States rely on SCCs and, depending on the data exporter, may also engage the EU-US Data Privacy Framework where applicable. UK GDPR imposes equivalent requirements for UK data exports, with the UK using its own international data transfer agreements (IDTAs). GOVERNANCE EXPOSURE: Medium. The reliance on SCCs for US transfers is standard practice but requires that a transfer impact assessment (TIA) be conducted to assess whether supplementary measures are needed given US surveillance law (particularly for data subject to FISA Section 702). The adequacy of AI21's TIA documentation is not disclosed in the policy. Israel's adequacy status reduces risk for Israel-bound transfers but should be monitored given the ongoing EU adequacy review cycle. JURISDICTION FLAGS: EU and EEA organizations using AI21 services should confirm that SCCs are executed and that TIAs have been completed. UK organizations should confirm that UK IDTAs or equivalent mechanisms are in place rather than EU SCCs, as the UK operates a separate transfer regime post-Brexit. Swiss organizations should note that Switzerland's Federal Act on Data Protection (nFADP) governs transfers, and AI21's reference to Switzerland alongside EU and UK suggests awareness of this requirement. CONTRACT AND VENDOR IMPLICATIONS: Enterprise procurement teams should request copies of AI21's executed SCCs and any available TIA documentation before onboarding AI21 as a data processor. Vendor assessments should confirm which specific legal entities are acting as data importers under the SCCs and whether sub-processors are covered. B2B contracts should specify the transfer mechanism applicable to the engagement. COMPLIANCE CONSIDERATIONS: Legal teams should update data transfer mapping to reflect AI21 as a recipient of EU and UK personal data transferred under SCCs. If AI21 is classified as a data processor for enterprise customers, the data processing agreement should incorporate the relevant transfer mechanism. Organizations should monitor EU Commission adequacy decisions affecting Israel and the US, as changes to adequacy status could require alternative transfer mechanisms.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Data transferred outside the EU or UK may be subject to different legal protections, and the adequacy of Standard Contractual Clauses as a transfer mechanism depends on whether supplementary measures are in place given the privacy laws of the recipient country.
EU, UK, and non-US users' personal data is routinely transferred to Israel and the United States, with Standard Contractual Clauses cited as the legal safeguard for EU and UK users. Israel has been recognized by the EU as providing adequate data protection under GDPR, though this adequacy status should be monitored as regulatory reviews continue.
ConductAtlas has identified this type of provision across 55 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by AI21 Labs.