Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that it only covers LlamaIndex's data practices as a controller, and explicitly excludes from its scope any personal data LlamaIndex processes on behalf of enterprise customers acting as processors; individuals whose data is processed in that context must direct requests to the relevant customer rather than to LlamaIndex.
This analysis describes what LlamaIndex's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a structural limitation on the scope of data subject rights exercisable directly against LlamaIndex, creating a dependency on enterprise customers' own privacy notices and processes for end users of LlamaIndex-powered products.
Under this clause, individuals whose personal data is processed by LlamaIndex at the direction of an enterprise customer cannot direct data subject requests to LlamaIndex and must instead contact the relevant customer organization for information about how their data is handled.
Cross-platform context
See how other platforms handle Controller-Processor Scope Exclusion and similar clauses.
Compare across platforms →Monitoring
LlamaIndex has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"This Privacy Notice describes our privacy practices where we are acting as the controller of personal data. However, this Privacy Notice does not cover or address how our customers may process personal data when they use our services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. As a result, we recommend referring to the privacy notice of the customer with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. In addition, we are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers, so we recommend directing any requests to the relevant customer.Excerpt from LlamaIndex's Privacy Policy
1) REGULATORY LANDSCAPE: The controller-processor distinction is a fundamental concept under GDPR, which imposes distinct obligations on controllers and processors including the requirement for a Data Processing Agreement between them. This provision's explicit exclusion of processor-mode activities from the notice's scope may require enterprise customers to maintain their own GDPR-compliant processing records and DPAs with LlamaIndex. Under CCPA, the equivalent distinction between businesses and service providers similarly governs downstream data rights. 2) GOVERNANCE EXPOSURE: High for enterprise customers. The exclusion of processor-mode data handling from this notice's scope means that enterprise customers deploying LlamaIndex in their own products bear primary responsibility for ensuring GDPR and CCPA compliance for their end users. The policy does not reference or describe the terms of any DPA that may govern the processor relationship. 3) JURISDICTION FLAGS: EU and EEA enterprise customers are subject to GDPR requirements to enter into DPAs with processors including LlamaIndex. California enterprise customers must ensure service provider agreements meet CCPA contractual requirements. 4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers should confirm that a current DPA or service provider agreement is in place with LlamaIndex governing processor-mode data handling. Procurement teams should request and review the DPA terms, including subprocessor lists, security commitments, and data subject rights handling procedures. The absence of a DPA could constitute a GDPR compliance gap. 5) COMPLIANCE CONSIDERATIONS: Enterprise customers' legal teams should audit whether their own privacy notices accurately describe LlamaIndex as a data processor and whether end user data subject rights requests can be fulfilled through the customer's own processes. Annual vendor assessment reviews should include LlamaIndex's DPA and subprocessor terms.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes a structural limitation on the scope of data subject rights exercisable directly against LlamaIndex, creating a dependency on enterprise customers' own privacy notices and processes for end users of LlamaIndex-powered products.
Under this clause, individuals whose personal data is processed by LlamaIndex at the direction of an enterprise customer cannot direct data subject requests to LlamaIndex and must instead contact the relevant customer organization for information about how their data is handled.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by LlamaIndex.