If you feed personal information into Bedrock's AI models, you are legally responsible for making sure you have the right to do so under privacy law — AWS's Data Processing Addendum does not automatically cover all privacy obligations.
This analysis describes what AWS Bedrock's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Customers processing personal data through Bedrock bear full legal responsibility for GDPR, CCPA, and other privacy law compliance — AWS's contractual protections are limited to what is specified in the Data Processing Addendum.
This change introduces a new optional service feature rather than modifying existing consumer rights or obligations. AWS explicitly disclaims providing regulated financial services, holding custody o…
Businesses processing personal data — including names, emails, or other identifiable information — through Bedrock's AI models must independently establish a valid legal basis under GDPR, CCPA, and other applicable laws, and must ensure their own privacy notices accurately describe this AI processing.
How other platforms handle this
To the extent that Duo processes any Personal Data (as defined in the Duo Privacy Data Sheet) on behalf of Customer in connection with Customer's use of the Services, the terms of the Duo Data Processing Agreement ('DPA'), which are hereby incorporated by reference into this Agreement, shall apply a...
Cloudflare's current Privacy Policy is incorporated into this Agreement by this reference and is located at https://www.cloudflare.com/privacypolicy/. In addition, by using the Services, you acknowledge and agree that internet transmissions are never completely private or secure.
If you access or use any of Oura's location-based services, such as by enabling GPS-based activity tracking through our Services, Oura may process the approximate or precise location of your device while the service is active. This data may be obtained via your device's service provider network ID, ...
Monitoring
AWS Bedrock has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"If you process personal data using Amazon Bedrock, you are responsible for ensuring that you have a lawful basis for such processing and that your use of Amazon Bedrock complies with applicable privacy laws, including the AWS Data Processing Addendum where applicable.— Excerpt from AWS Bedrock's AWS Service Terms
REGULATORY FRAMEWORK: This provision directly implicates GDPR Art. 6 (lawful basis), Art. 13-14 (transparency obligations), Art. 28 (processor agreements), and Art. 35 (DPIA requirements for high-risk AI processing). CCPA §1798.100 and §1798.120 apply for California residents. Brazil's LGPD (Art. 7) and Canada's PIPEDA impose parallel obligations for customers with users in those jurisdictions. The EU AI Act (Art. 10, 26) imposes additional data governance obligations for AI systems processing personal data. Enforcement authorities include EU DPAs (lead authority determined by controller establishment), California CPPA, and FTC.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and liability.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Customers processing personal data through Bedrock bear full legal responsibility for GDPR, CCPA, and other privacy law compliance — AWS's contractual protections are limited to what is specified in the Data Processing Addendum.
Businesses processing personal data — including names, emails, or other identifiable information — through Bedrock's AI models must independently establish a valid legal basis under GDPR, CCPA, and other applicable laws, and must ensure their own privacy notices accurately describe this AI processing.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by AWS Bedrock.