Mistral AI Data Processing Addendum

This Data Processing Addendum (DPA), effective March 12, 2026, governs the processing of personal data by Mistral AI on behalf of commercial customers under the main service agreement, establishing Mistral AI as a Processor and the customer as the Controller under GDPR and CCPA frameworks. The agreement states that Mistral AI processes personal data only on documented customer instructions, but separately authorizes Mistral AI to act as Controller for purposes including AI model training (unless the customer opts out or uses a product opted out by default), automated abuse moderation, and aggregated usage analytics. Notably, the DPA permits Mistral AI to terminate the agreement or affected products if a customer objects to a new subprocessor appointment and no resolution is reached within a 10-day objection window, a condition that places practical leverage on the vendor side; additionally, on-site audit rights are constrained by a 90-day advance notice requirement, a joint auditor selection process, and a customer-borne cost structure, which together represent a more restricted audit framework than some enterprise data processing agreements. The DPA explicitly engages GDPR (including SCCs via EU Commission Decision 2021/914 for international data transfers) and CCPA, with French law governing SCC Module 4 disputes for customers in non-adequate third countries. Compliance teams should evaluate the opt-out configuration for AI model training, the subprocessor notification subscription mechanism via the Trust Center, and the 30-day post-termination data deletion timeline against their own data retention and regulatory obligations.