If you feed personal information into Bedrock's AI models, you are legally responsible for making sure you have the right to do so under privacy law — AWS's Data Processing Addendum does not automatically cover all privacy obligations.
This analysis describes what AWS Bedrock's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The provision allocates data processing compliance responsibility to the customer rather than AWS, establishing that AWS Bedrock does not automatically create lawful processing authority and that customers must independently verify regulatory compliance before deployment.
The updated terms now explicitly state that AWS IoT SiteWise Scenario Discovery is not designed for real-time vehicle control and cannot be used as the sole basis for determining vehicle safety or regulatory compliance. Organizations deploying this service must implement independent human monitoring and safety validation before using its outputs to support vehicle system decisions. The terms make clear that AWS assumes no responsibility for uses that violate these constraints.
View change record →The updated terms establish new restrictions on how AWS Capacity Reservations may be used. Specifically, customers purchasing On-Demand Capacity Reservations can no longer resell them to other parties, and AWS reserves the right to cancel the purchase or terminate running instances if the company suspects resale activity. For Capacity Blocks for ML, the grace period before instance termination increased from 30 minutes to 60 minutes for UltraServer instance types, allowing slightly more time to complete workloads. The Amazon Sidewalk qualification program was renamed and simplified, but the underlying security and operational requirements remain in effect.
View change record →The updated terms establish a formal framework for AWS Bedrock's free exploration services, clarifying the operational boundaries and responsibilities. AWS reserves the right to discontinue these services at any time without prior notice, meaning customers cannot rely on their continuation for production planning. Customers are solely responsible for testing, deploying, and maintaining any code, documents, or AI solutions AWS provides, including determining whether those solutions comply with applicable law. AWS retains the right to develop competing products based on content it creates during these engagements, though this does not override existing non-disclosure agreements. Customers are prohibited from requiring AWS personnel to sign additional terms as a condition of receiving free services, and any such documentation signed by AWS personnel is void.
View change record →Businesses processing personal data — including names, emails, or other identifiable information — through Bedrock's AI models must independently establish a valid legal basis under GDPR, CCPA, and other applicable laws, and must ensure their own privacy notices accurately describe this AI processing.
How other platforms handle this
We use your personal information to comply with applicable legal and regulatory obligations and respond to legally valid requests and communications from law enforcement authorities to the extent required by applicable law.
We may infer certain information from your interactions with the Lyft Platform and other personal information available to us. For example, if you frequently ride to or from airports, we may infer you are a frequent traveler.
we may use this information to make it easier for you to find the people you want to send payments to, for account and identity verification and fraud prevention purposes, to reduce the risk you will send payments to the wrong person, or to provide other personalized services.
"If you process personal data using Amazon Bedrock, you are responsible for ensuring that you have a lawful basis for such processing and that your use of Amazon Bedrock complies with applicable privacy laws, including the AWS Data Processing Addendum where applicable.Excerpt from AWS Bedrock's AWS Service Terms
REGULATORY FRAMEWORK: This provision directly implicates GDPR Art.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and liability.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The provision allocates data processing compliance responsibility to the customer rather than AWS, establishing that AWS Bedrock does not automatically create lawful processing authority and that customers must independently verify regulatory compliance before deployment.
Businesses processing personal data — including names, emails, or other identifiable information — through Bedrock's AI models must independently establish a valid legal basis under GDPR, CCPA, and other applicable laws, and must ensure their own privacy notices accurately describe this AI processing.
ConductAtlas has identified this type of provision across 278 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by AWS Bedrock.