EEA and UK User Rights under GDPR

What it is

If you're in the EU, UK, or Switzerland, you have strong legal rights over your data under GDPR, including the ability to access, correct, delete, or move your information, and to complain to your country's data regulator.

Why it matters (compliance & governance perspective)

GDPR rights are among the strongest consumer data protections globally, and Grammarly's policy acknowledges them for EEA and UK users, meaning those users have enforceable legal recourse if their data is mishandled.

Consumer impact (what this means for users)

EEA and UK users can request access to, correction or deletion of, or restriction of processing of their personal data held by Grammarly, and can object to processing based on legitimate interests including AI model training; these rights can be exercised through Grammarly's privacy portal.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision engages GDPR (Regulation 2016/679), enforced by national data protection authorities including the Irish Data Protection Commission as Grammarly's likely EU lead supervisory authority given its EU operations. UK GDPR, enforced by the Information Commissioner's Office, applies to UK users. Cross-border data transfers from the EEA to the US must rely on adequacy decisions, standard contractual clauses, or other approved mechanisms, and the policy's adequacy for these transfer mechanisms should be verified. GOVERNANCE EXPOSURE: High for EEA/UK operations. The combination of broad data collection, AI training use of user content, and third-party sharing creates meaningful exposure under GDPR's purpose limitation, data minimization, and lawful basis requirements. The right to object to processing based on legitimate interests, if exercised by EEA users specifically in relation to AI training, would require Grammarly to demonstrate compelling legitimate grounds. JURISDICTION FLAGS: Ireland, Germany, France, and the Netherlands have active DPA enforcement postures. UK ICO has independent enforcement authority post-Brexit. Swiss users are subject to the revised Swiss Federal Act on Data Protection. Organizations with EEA-based users or employees should ensure their own GDPR-compliant data processing records reflect Grammarly's role as a processor or controller as applicable. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers with EEA users must confirm that a GDPR-compliant data processing agreement (DPA) is in place with Grammarly. The DPA should specify Grammarly's role (processor or controller), lawful bases for processing, sub-processor lists, and cross-border transfer mechanisms. The absence of an adequate DPA creates direct compliance exposure for enterprise customers. COMPLIANCE CONSIDERATIONS: Legal teams should verify that Grammarly's transfer impact assessments for US-bound data transfers are current and adequate given the evolving EU-US data transfer landscape. Data subject request response procedures should be tested for timeliness and completeness. Organizations should confirm that Grammarly's privacy portal is accessible to EEA users and that response timelines meet GDPR's one-month standard.

Applicable regulations

Provision details

Other risks in this policy

• User Content Used for AI Model Training high
• Data Sharing with Business Partners and Third Parties medium
• Corporate Transaction Data Transfer medium
• California Resident Rights and Opt-Out of Sale or Sharing medium
• Age Restriction and Children's Data medium
• Cross-Border Data Transfers medium