Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The DPA requires Perplexity to flow down DPA obligations to subcontractors and states that Perplexity remains fully liable for subcontractor performance failures under EU/UK Privacy Laws.
This analysis describes what Perplexity AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes Perplexity's full liability for subcontractor failures under EU/UK Privacy Laws, consistent with GDPR Article 28(4), and requires written sub-processor agreements with equivalent obligations.
This addition ensures Perplexity maintains full liability for subcontractor failures under EU/UK Privacy Laws despite contractual pass-through obligations, protecting customers under GDPR/UK GDPR frameworks.
View full change record →Under this clause, Perplexity remains contractually and legally liable for the performance of its subcontractors under EU/UK Privacy Laws, providing Customer with a single point of accountability for sub-processor failures.
Cross-platform context
See how other platforms handle Subprocessor Liability under EU/UK Privacy Laws and similar clauses.
Compare across platforms →Monitoring
Perplexity AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Perplexity shall engage subcontractors only pursuant to a written agreement that contains obligations on the subcontractor which are no less onerous on the relevant subcontractor than the obligations on Perplexity under this DPA. In the event Perplexity engages a subcontractor to carry out specific processing activities on behalf of Customer pursuant to EU/UK Privacy Laws, where that subcontractor fails to fulfil its obligations, Perplexity shall remain fully liable under applicable EU/UK Privacy Laws to Customer for the performance of that subcontractor's obligations.Excerpt from Perplexity AI's Perplexity Data Processing Addendum
REGULATORY LANDSCAPE: This provision directly implements GDPR Article 28(4) requirements, which establish that where a sub-processor fails to fulfill its data protection obligations, the initial processor (Perplexity) remains fully liable to the controller. The Irish DPC is the designated competent supervisory authority for EU enforcement purposes. UK GDPR imposes equivalent requirements. GOVERNANCE EXPOSURE: Low. The provision is consistent with GDPR Article 28(4) mandatory requirements and is standard in compliant processor agreements. However, the practical scope of Perplexity's liability is limited to EU/UK Privacy Laws contexts, and the DPA does not expressly extend equivalent liability for subcontractor failures under US Privacy Laws. JURISDICTION FLAGS: EU/EEA and UK customers have the clearest contractual protection under this provision. US customers should assess whether equivalent subcontractor liability is available under applicable US state law or must be negotiated separately. CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should request copies of or representations about Perplexity's sub-processor agreements to confirm that equivalent obligations are flowed down, particularly for Model Providers listed in Annex 2. The reference to Amazon Web Services and Microsoft as security measure subcontractors in Annex 3 indicates that these entities process Personal Data in scope. COMPLIANCE CONSIDERATIONS: Legal teams should confirm that the sub-processor list in Annex 2 and the Third-Party Providers list are current and that Perplexity has executed Processor-to-Processor Clauses with each subcontractor processing Personal Data in Third Countries.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes Perplexity's full liability for subcontractor failures under EU/UK Privacy Laws, consistent with GDPR Article 28(4), and requires written sub-processor agreements with equivalent obligations.
Under this clause, Perplexity remains contractually and legally liable for the performance of its subcontractors under EU/UK Privacy Laws, providing Customer with a single point of accountability for sub-processor failures.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Perplexity AI.