The DPA incorporates EU SCCs (Commission Decision 2021/914, Module 2 and Module 3) and the UK International Data Transfer Addendum for cross-border data transfers, designating the Irish Data Protection Commission as competent supervisory authority and Irish law and courts as governing law for SCC purposes.
This analysis describes what Perplexity AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the contractual mechanism for lawful transfer of Personal Data from the EU/UK to Perplexity's US-based infrastructure, including the designation of the Irish DPC as lead supervisory authority, which affects regulatory oversight and enforcement jurisdiction for covered data subjects.
Business customers using Perplexity services are now governed by an updated DPA with two material operational changes. First, subprocessor disclosures have shifted from a static document attachment (Annex 2) to a live online list maintained at https://trust.perplexity.ai/subprocessors, with notifications of changes coming through in-product notification or email rather than through formal amendment. Second, certain Perplexity services (specifically Embeddings API and Perplexity Search) now operate under product-specific data postures and terms that control over the main DPA, meaning the data handling for those services may differ from the baseline agreement. Business customers should review the Trust Center list regularly and check for in-product notifications regarding subprocessor changes, as the updated terms no longer require static amendment cycles.
View change record →The agreement incorporates EU SCCs and the UK Transfer Addendum as the legal basis for cross-border data transfers, with the Irish DPC designated as the competent supervisory authority and Irish courts as the forum for SCC-related disputes.
Cross-platform context
See how other platforms handle EU/UK Standard Contractual Clauses Incorporation and similar clauses.
Compare across platforms →"To the extent Perplexity processes Personal Data subject to EU/UK Privacy Laws in a Third Country, and it is acting as a data importer, Perplexity shall comply with the data importer's obligations set out in the Controller to Processor Clauses or the Processor to Processor Clauses (as applicable), which are hereby incorporated into and form part of this DPA... for the purposes of Clause 13 and Annex I.C, the competent supervisory authority shall be the Irish regulator; (iv) Clauses 17 and 18, Option 1 is deemed to be selected and the governing law and the competent courts shall be Irish law and Irish courts, respectively.Excerpt from Perplexity AI's Perplexity Data Processing Addendum
REGULATORY LANDSCAPE: This provision engages GDPR Chapter V (international data transfers), the EU SCCs under Commission Decision 2021/914, and the UK International Data Transfer Addendum.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the contractual mechanism for lawful transfer of Personal Data from the EU/UK to Perplexity's US-based infrastructure, including the designation of the Irish DPC as lead supervisory authority, which affects regulatory oversight and enforcement jurisdiction for covered data subjects.
The agreement incorporates EU SCCs and the UK Transfer Addendum as the legal basis for cross-border data transfers, with the Irish DPC designated as the competent supervisory authority and Irish courts as the forum for SCC-related disputes.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Perplexity AI.