Governance document

CA-D-000771

Mistral AI Data Processing Addendum

Mistral AI

Last change detected July 28, 2026 Data processing addendum

SHA-256: d3d8da540e833750342… 2 versions captured 1 change documented

Get the research letter

Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.

View original document at Mistral AI ↗

This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology

62 Total

25 High severity

34 Medium severity

3 Low severity

Key Facts

Is Mistral AI prohibited from combining Personal Data with any other personal data or information?

Mistral AI is prohibited from combining Personal Data with any other personal data or information it collects, directly or via any third party, except as expressly permitted under Applicable Data Protection Law for Processors.

What is Mistral AI prohibited from combining Personal Data with?

Is Mistral AI prohibited from processing Personal Data for any commercial purpose?

Mistral AI is prohibited from processing Personal Data for any commercial purpose other than as necessary to provide the Mistral AI Products to Customer.

What commercial purposes is Mistral AI prohibited from processing Personal Data for?

Mistral AI is prohibited from processing Personal Data for any commercial purpose other than as necessary to provide the Mistral AI Products to Customer.

Is Mistral AI prohibited from processing Personal Data outside of the direct business relationship between Mistral AI as Processor and Customer?

Mistral AI is prohibited from processing Personal Data outside of the direct business relationship between Mistral AI as Processor and Customer.

Does Customer grant Mistral AI authorization to appoint Subprocessors?

Customer grants Mistral AI a prior and general authorization to appoint Subprocessors to assist in the provision of the Mistral AI Products and in the Processing, in accordance with the terms of the DPA.

What does Customer grant Mistral AI authorization to appoint Subprocessors to do?

What must Customer provide for Mistral AI to process Personal Data under the DPA?

Customer is required to provide notice and obtain all consents and rights required by Applicable Data Protection Law for Mistral AI to process Personal Data under the DPA.

What must Customer obtain for Mistral AI to process Personal Data under the DPA?

Customer is required to provide notice and obtain all consents and rights required by Applicable Data Protection Law for Mistral AI to process Personal Data under the DPA.

As what is Mistral AI authorized to process Personal Data?

Mistral AI is authorized to process Personal Data as Controller for the purpose of training its artificial intelligence models in accordance with its Privacy Policy, unless the Customer has opted out of training or uses a Mistral AI Product that is opted out by default and has not opted in.

Stay ahead of the changes

Track Mistral AI and get the diff the day its terms change.

Monitor Mistral AI + up to 20 platforms — $4.99/mo →

Summary

This document is a data processing agreement that sets out how Mistral AI handles personal data it processes on a business customer's behalf. Mistral AI is only permitted to use that data to deliver its products, not for broader commercial purposes, and must delete or return all data after the service ends. Mistral AI may also use personal data to train its AI models as a Controller, unless the customer has opted out or uses a product that defaults to opted-out.

Analysis

This Data Processing Addendum establishes the terms under which Mistral AI processes Personal Data as a Processor on behalf of Customer, confining all processing to what is necessary to provide the Mistral AI Products within the direct Processor-Customer relationship. Mistral AI is prohibited from combining Personal Data with other data it collects or from processing it for any commercial purpose outside service delivery. Customer bears the obligation to provide required notices and obtain all consents under Applicable Data Protection Law. Mistral AI retains a distinct Controller role for AI model training purposes, subject to Customer opt-out rights. The addendum incorporates Module 4 Standard Contractual Clauses for International Data Transfers, requires prompt breach notification, mandates ongoing technical and organizational security measures, and preserves Mistral AI's liability for Subprocessor failures under a prior and general authorization to engage Subprocessors.

What this means for you

For individuals whose personal data is processed through a business customer's use of Mistral AI products, this document limits Mistral AI to processing that data solely to provide those products and prohibits combining it with other datasets. Mistral AI may process personal data as a Controller to train its AI models unless the business customer has opted out of training or uses a product that defaults to opt-out. If your organization is a Mistral AI customer, it can opt out of AI training data use, which stops Mistral AI from acting as Controller over your personal data for that purpose.

Institutional Analysis

Stay ahead of the changes

Institutional analysis available with Insight

Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.

Monitor Mistral AI + up to 20 platforms — $4.99/mo → Get the research letter, free

1 important change detected

2 versions captured · Last updated: July 2026

July 28, 2026

low

What changed Mistral AI updated its Data Processing Addendum effective July 27, 2026, making four targeted revisions. The most significant change clarified the conditions under which Mistral AI may use personal data for AI model training: the prior language required opt-out by either the customer or the product default status, while the updated language states that Mistral AI may train unless 'Customer is or has opted-out of training,' simplifying the opt-out condition. Additional changes include correcting a tense issue regarding data transfer authorization (from 'authorized' to 'authorizes') and minor wording adjustments to audit provisions (removing 'the' before 'a'). These revisions clarify operational procedures without materially expanding or restricting processing rights.

Why this matters The updated Data Processing Addendum clarifies the conditions under which Mistral AI may train its AI models on customer data. Previously, the language stated that Mistral AI could train unless the customer opted out or the product was opted out by default without opt-in; the revised language states that Mistral AI may train unless the customer is or has opted out. This simplifies the opt-out framework by establishing a single condition rather than a dual condition. Customers retain the ability to opt out of AI training, and the revision does not expand Mistral AI's processing rights beyond what was previously permitted.

View full change record →

Featured, High severity

CCPA prohibition on combining Personal Data with other data Compare →

This prohibition limits Mistral AI's ability to enrich or pool Personal Data with other datasets, which would otherwise expand its informational profile of individuals beyond what the service relationship requires.

Added July 10, 2026 Standard Seen across 279 platforms
CCPA prohibition on processing for commercial purposes beyond service Compare →

This restriction prevents Mistral AI from monetising or otherwise exploiting Personal Data for commercial ends that fall outside the scope of service delivery to the Customer.

Added July 10, 2026 Standard Seen across 279 platforms
CCPA prohibition on processing outside direct business relationship Compare →

This restriction confines all processing of Personal Data to the defined Processor-Customer relationship, preventing Mistral AI from using Personal Data in any context that falls outside that relationship.

Added July 10, 2026 Standard Seen across 279 platforms
Customer grants general authorization for Subprocessors Compare →

A prior and general authorization means Customer does not need to approve each Subprocessor individually, giving Mistral AI broad latitude to engage third parties to process Personal Data.

Added July 10, 2026 Standard Seen across 288 platforms
Customer must obtain all required consents for processing Compare →

This requirement places the legal burden of establishing a valid basis for processing on the Customer, meaning Mistral AI's processing is contingent on Customer having fulfilled these obligations.

Added July 10, 2026 Standard Seen across 296 platforms
Mistral AI authorized to train AI models as Controller Compare →

This authorization allows Mistral AI to act as Controller—not just Processor—over Personal Data for AI training, a distinct and broader role that carries different legal consequences, subject to opt-out conditions.

Added July 10, 2026 Standard Seen across 217 platforms
Mistral AI deletes or returns Personal Data after termination Compare →

This clause governs what happens to Personal Data at the end of the service relationship, but the choice between deletion and return, and the timing, are governed by Mistral AI's own policies and procedures rather than Customer-specified terms.

Added July 10, 2026 Standard Seen across 275 platforms
Mistral AI must implement technical and organizational security measures Compare →

This obligation sets a minimum security standard tied to Applicable Data Protection Law and requires ongoing maintenance, meaning Mistral AI cannot implement measures once and consider its obligation discharged.

Added July 10, 2026 Standard Seen across 296 platforms
Mistral AI must notify Customer of Personal Data Breach without undue delay Compare →

The 'without undue delay' standard triggers Mistral AI's notification duty promptly upon awareness, enabling Customer to take timely action, but the clause does not specify a fixed deadline.

Added July 10, 2026 Standard Seen across 273 platforms
Mistral AI processes data as Processor only Compare →

The designation of Mistral AI as Processor rather than Controller determines the legal framework governing its data processing obligations and limits its authority over Personal Data to what the Customer instructs.

Added July 10, 2026 Standard Seen across 279 platforms
Mistral AI remains liable for Subprocessor data protection failures Compare →

This retained liability means that engaging Subprocessors does not transfer legal accountability away from Mistral AI toward Customer, preserving Customer's ability to hold Mistral AI responsible for Subprocessor failures.

Added July 10, 2026 Standard Seen across 229 platforms
Module 4 SCCs incorporated for Customer in Restricted Country Compare →

Incorporating Module 4 SCCs by acceptance of the DPA provides the legal mechanism for cross-border data transfers where Mistral AI acts as Processor, without requiring a separate agreement for each transfer.

Added July 10, 2026 Standard Seen across 267 platforms