CoreWeave acts as a data controller for information it collects directly from users, but may act as a data processor when enterprise customers run workloads that involve third-party personal data on CoreWeave's infrastructure.
If you are an enterprise customer using CoreWeave to process data about your own customers or employees, you are legally responsible for that data under GDPR — CoreWeave's role as your processor must be formalized in a written agreement.
Cross-platform context
See how other platforms handle Data Controller vs. Processor Distinction and similar clauses.
Compare across platforms →Enterprise customers who process personal data on CoreWeave's infrastructure bear legal responsibility as data controllers and must ensure a compliant Data Processing Agreement is in place with CoreWeave.
(1) REGULATORY FRAMEWORK: The controller/processor distinction is governed by GDPR Art. 4(7) and (8), with processor obligations specified in Art. 28 (written DPA required), Art. 29 (processing only on controller's instructions), and Art. 32 (security obligations). UK GDPR and Swiss nFADP impose equivalent requirements. CCPA's service provider framework (§1798.140(ag)) creates analogous obligations for California-regulated data flows. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.