The terms incorporate the AWS DPA, the EU SCCs under Commission Implementing Decision 2021/914, the UK GDPR Addendum, the Swiss Addendum, and the CCPA Terms by reference, with each framework applying conditionally based on whether the relevant data protection regulation governs the customer's use of AWS services.
This analysis describes what AWS Bedrock's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The conditional incorporation of multiple international data protection frameworks by reference means that the applicable contractual obligations for personal data processing depend on the customer's jurisdiction and the nature of data processed, requiring customers to assess which addenda apply to their specific use cases.
The updated terms remove the explicit reference to a Data Processing Addendum governing Anthropic data transfers, though the requirement to obtain opt-in consent for Anthropic model use remains in place. For Kiro users, the revised language now explicitly states that abuse detection includes retention and potential human review of inputs and outputs when selecting certain models. Users of Anthropic models on Bedrock should verify opt-in consent mechanisms in service documentation to understand data handling practices.
View change record →The updated terms establish a new project-based service structure for AWS (new) users, effective August 17, 2026, with new rules governing team member access and content ownership. Users who enable spend limits agree that AWS may suspend their account or project access upon reaching their limit, and may permanently close the account or project if not reactivated within an unspecified timeframe. Contributed content by team members becomes the project owner's property and is subject to a nonexclusive irrevocable license granted to all project members. You can configure AI services opt-out policies through AWS Settings; project owners can manage team member permissions and access controls.
View change record →The updated terms now explicitly state that AWS IoT SiteWise Scenario Discovery is not designed for real-time vehicle control and cannot be used as the sole basis for determining vehicle safety or regulatory compliance. Organizations deploying this service must implement independent human monitoring and safety validation before using its outputs to support vehicle system decisions. The terms make clear that AWS assumes no responsibility for uses that violate these constraints.
View change record →Under these terms, the data protection framework governing customer data processed through AWS services is determined by the applicable jurisdiction and type of processing, with separate addenda for GDPR, UK GDPR, Swiss FDPA, CCPA, and EU Data Act scenarios each applying conditionally.
Cross-platform context
See how other platforms handle Incorporated Data Protection Frameworks and similar clauses.
Compare across platforms →"These Service Terms incorporate the AWS Data Processing Addendum ("DPA"), when you use AWS Services to process Customer Data (as defined in the DPA). These Service Terms incorporate the Standard Contractual Clauses between controllers and processors ("Controller-to-Processor Clauses") and the Standard Contractual Clauses between processors ("Processor-to-Processor Clauses") approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the "SCCs"). The SCCs will only apply when: (i) the GDPR applies to your use of the AWS Services to process Customer Data; and (ii) Customer Data is transferred either directly or via onward transfer, to a country outside of the European Economic Area not recognised by the European Commission as providing an adequate level of protection for personal data subject to GDPR (together a "Data Transfer").Excerpt from AWS Bedrock's AWS Service Terms
REGULATORY LANDSCAPE: This provision incorporates contractual mechanisms required under GDPR Chapter V for international data transfers, including the SCCs approved by EU Commission Implementing Decision (EU) 2021/914.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The conditional incorporation of multiple international data protection frameworks by reference means that the applicable contractual obligations for personal data processing depend on the customer's jurisdiction and the nature of data processed, requiring customers to assess which addenda apply to their specific use cases.
Under these terms, the data protection framework governing customer data processed through AWS services is determined by the applicable jurisdiction and type of processing, with separate addenda for GDPR, UK GDPR, Swiss FDPA, CCPA, and EU Data Act scenarios each applying conditionally.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by AWS Bedrock.