The DPA requires Perplexity to flow down DPA obligations to subcontractors and states that Perplexity remains fully liable for subcontractor performance failures under EU/UK Privacy Laws.
This analysis describes what Perplexity AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes Perplexity's full liability for subcontractor failures under EU/UK Privacy Laws, consistent with GDPR Article 28(4), and requires written sub-processor agreements with equivalent obligations.
Business customers using Perplexity services are now governed by an updated DPA with two material operational changes. First, subprocessor disclosures have shifted from a static document attachment (Annex 2) to a live online list maintained at https://trust.perplexity.ai/subprocessors, with notifications of changes coming through in-product notification or email rather than through formal amendment. Second, certain Perplexity services (specifically Embeddings API and Perplexity Search) now operate under product-specific data postures and terms that control over the main DPA, meaning the data handling for those services may differ from the baseline agreement. Business customers should review the Trust Center list regularly and check for in-product notifications regarding subprocessor changes, as the updated terms no longer require static amendment cycles.
View change record →This addition ensures Perplexity maintains full liability for subcontractor failures under EU/UK Privacy Laws despite contractual pass-through obligations, protecting customers under GDPR/UK GDPR frameworks.
View full change record →Under this clause, Perplexity remains contractually and legally liable for the performance of its subcontractors under EU/UK Privacy Laws, providing Customer with a single point of accountability for sub-processor failures.
Cross-platform context
See how other platforms handle Subprocessor Liability under EU/UK Privacy Laws and similar clauses.
Compare across platforms →"Perplexity shall engage subcontractors only pursuant to a written agreement that contains obligations on the subcontractor which are no less onerous on the relevant subcontractor than the obligations on Perplexity under this DPA. In the event Perplexity engages a subcontractor to carry out specific processing activities on behalf of Customer pursuant to EU/UK Privacy Laws, where that subcontractor fails to fulfil its obligations, Perplexity shall remain fully liable under applicable EU/UK Privacy Laws to Customer for the performance of that subcontractor's obligations.Excerpt from Perplexity AI's Perplexity Data Processing Addendum
REGULATORY LANDSCAPE: This provision directly implements GDPR Article 28(4) requirements, which establish that where a sub-processor fails to fulfill its data protection obligations, the initial processor (Perplexity) remains fully liable to the controller.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes Perplexity's full liability for subcontractor failures under EU/UK Privacy Laws, consistent with GDPR Article 28(4), and requires written sub-processor agreements with equivalent obligations.
Under this clause, Perplexity remains contractually and legally liable for the performance of its subcontractors under EU/UK Privacy Laws, providing Customer with a single point of accountability for sub-processor failures.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Perplexity AI.