Captured before automated identity checks (Oct 14, 2026): accurate as of its capture on Sep 11, 2026; our capture on Oct 21, 2026 found the same text, but its identity was not checked by them.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
“Mistral AI shall not:...(iv) combine Personal Data with any other personal data or information it collects (directly or via any third party) other than as expressly permitted under Applicable Data Protection Law for Processors.”
“Mistral AI shall not: (i) Process the Personal Data for a commercial purpose other than as necessary to provide the Mistral AI Products to Customer.”
“Mistral AI shall not:...(iii) Process the Personal Data outside of the direct business relationship between Processor and Customer.”
“Customer provides a prior and general authorization allowing Mistral AI to appoint any Subprocessors to assist Mistral AI in the provision of the Mistral AI Products and in the Processing, in accordance with the terms of this DPA.”
“Provide notice and obtain all consents and rights required by the Applicable Data Protection Law for Mistral AI to Process Personal Data as part of the Processing, under this DPA.”
“After the end of the provision of the Mistral AI Products, Mistral AI will delete or return to Customer all Personal Data Processed on Customer's behalf, in accordance with Mistral AI's deletion policies and procedures.”
This document is a data processing agreement that sets out how Mistral AI handles personal data it processes on a business customer's behalf. Mistral AI is only permitted to use that data to deliver its products, not for broader commercial purposes, and must delete or return all data after the service ends. Mistral AI may also use personal data to train its AI models as a Controller, unless the customer has opted out or uses a product that defaults to opted-out.
This Data Processing Addendum establishes the terms under which Mistral AI processes Personal Data as a Processor on behalf of Customer, confining all processing to what is necessary to provide the Mistral AI Products within the direct Processor-Customer relationship. Mistral AI is prohibited from combining Personal Data with other data it collects or from processing it for any commercial purpose outside service delivery. Customer bears the obligation to provide required notices and obtain all consents under Applicable Data Protection Law. Mistral AI retains a distinct Controller role for AI model training purposes, subject to Customer opt-out rights. The addendum incorporates Module 4 Standard Contractual Clauses for International Data Transfers, requires prompt breach notification, mandates ongoing technical and organizational security measures, and preserves Mistral AI's liability for Subprocessor failures under a prior and general authorization to engage Subprocessors.
For individuals whose personal data is processed through a business customer's use of Mistral AI products, this document limits Mistral AI to processing that data solely to provide those products and prohibits combining it with other datasets. Mistral AI may process personal data as a Controller to train its AI models unless the business customer has opted out of training or uses a product that defaults to opt-out. If your organization is a Mistral AI customer, it can opt out of AI training data use, which stops Mistral AI from acting as Controller over your personal data for that purpose.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
1 important change detected
6 versions captured · Latest change detected by ConductAtlas: July 2026
We withheld clauses we had published from this document. Each withholding is recorded in our correction log:
“Mistral AI shall not:...(iv) combine Personal Data with any other personal data or information it collects (directly or via any third party) other than as expressly permitted under Applicable Data Protection Law for Processors.”
“Mistral AI shall not: (i) Process the Personal Data for a commercial purpose other than as necessary to provide the Mistral AI Products to Customer.”
“Mistral AI shall not:...(iii) Process the Personal Data outside of the direct business relationship between Processor and Customer.”
“Customer provides a prior and general authorization allowing Mistral AI to appoint any Subprocessors to assist Mistral AI in the provision of the Mistral AI Products and in the Processing, in accordance with the terms of this DPA.”
“Provide notice and obtain all consents and rights required by the Applicable Data Protection Law for Mistral AI to Process Personal Data as part of the Processing, under this DPA.”
“After the end of the provision of the Mistral AI Products, Mistral AI will delete or return to Customer all Personal Data Processed on Customer's behalf, in accordance with Mistral AI's deletion policies and procedures.”
“Mistral AI shall implement and maintain technical and organizational measures designed to protect Personal Data from any Personal Data Breach that meet or exceed requirements under Applicable Data Protection Law.”
“Mistral AI shall notify Customer of any Personal Data Breach without undue delay after becoming aware of such Personal Data Breach.”
“Mistral AI Processes the Personal Data on behalf of Customer as a Processor.”
“Mistral AI will remain liable to Customer if such Subprocessor fails to fulfill its data protection obligations with regard to the relevant Processing activities under the DPA.”
“By accepting this DPA, Mistral AI and Customer conclude Module 4 (Processor-to-Controller) of the SCCs which applies to any International Data Transfer conducted by Mistral AI acting as a Data Processor and is hereby incorporated...”
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
Mistral AI has updated this document before. Monitor includes alerts from a daily check, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle CCPA prohibition on combining Personal Data with other data and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 343 platforms.