Is Perplexity AI GDPR Compliant? A 2026 Guide for European Teams

Short answer: Perplexity AI does not offer an enterprise Data Processing Addendum (DPA) as of 2026, processes data exclusively on US-based infrastructure, and has no EU data residency option. This makes it unsuitable for processing personal data of EU data subjects on behalf of an organisation under the GDPR's Article 28 controller-processor framework. Perplexity is a powerful research and search tool for personal use; it is not configured for regulated business use involving European personal data. This guide explains why the GDPR gap exists, what European teams should do instead, and where Perplexity may fit without creating compliance exposure.

What Perplexity AI is — and what GDPR requires

Perplexity is an AI-powered search and answer engine that retrieves real-time web content, synthesises it using large language models, and presents cited answers. Unlike ChatGPT or Claude, which are primarily generative tools, Perplexity's primary feature is live retrieval — it actively queries the web as part of responding to a prompt. This architecture has GDPR implications beyond the prompt itself: the retrieval process can involve requesting and processing URLs, excerpts, and metadata from across the public web in response to queries that may contain personal information.

The GDPR's requirements that apply as soon as a controller's employee uses Perplexity for work are the same six obligations that apply to any AI tool:

• Lawful basis (Article 6) for each processing activity.
• Special-category data (Article 9) — explicit consent or a narrow exemption for health, racial origin, political opinion, and similar data.
• Transparency (Articles 13–14) — data subjects must be told that their data is being processed using Perplexity.
• Data subject rights (Articles 15–22) — access, erasure, portability, restriction.
• International transfers (Chapter V) — a lawful mechanism for EEA-to-US transfers.
• Security of processing (Article 32) — appropriate technical measures.

For these obligations to be dischargeable, the controller needs a controller-processor DPA under Article 28. Perplexity does not offer one.

Perplexity's current GDPR posture (2026)

| Attribute | Status | | --- | --- | | Enterprise DPA available | No | | EU data residency | No | | Training on user queries | Not disclosed in detail; applies to personalisation features | | Sub-processor list | Not publicly disclosed in full | | BAA for HIPAA workloads | No | | Compliance certifications | SOC 2 Type II (as of late 2025) |

The absence of an enterprise DPA is the decisive gap. Article 28(3) of the GDPR requires that processing by a processor is "governed by a contract or other legal act under Union or Member State law." Without a DPA, there is no Article 28 agreement — and without an Article 28 agreement, using Perplexity to process personal data of EU data subjects on behalf of an employer is a breach of the GDPR regardless of the underlying security posture.

Perplexity's privacy policy (as of 2026) is written for end-user privacy, not controller-processor compliance. It describes data retention in consumer terms, does not disclose a comprehensive sub-processor list, and does not reference the GDPR's Article 28 requirements.

The retrieval architecture and its GDPR implications

Perplexity's real-time web retrieval creates an additional consideration that purely generative tools do not have. When a user enters a query, Perplexity:

1. Processes the query text (which may contain personal data).
2. Issues web search queries that may include terms from the user's prompt.
3. Retrieves content from third-party URLs.
4. Synthesises a response from that content.

If a query contains a person's name — "summarise what's known about [patient name]'s condition" or "find recent news about [executive name]" — that name may appear in the search queries Perplexity issues to third-party search engines and content providers. This expands the data-flow footprint beyond the single Perplexity platform and into an undisclosed set of third-party retrieval partners.

Under the GDPR, this retrieval architecture arguably creates two separate processing activities: (1) the processing of the prompt by Perplexity itself, and (2) the onward disclosure to third-party search and retrieval infrastructure. Both require lawful basis, documented transfer mechanisms for EU-to-US flows, and disclosed recipients. Perplexity's current documentation does not address either with GDPR-required specificity.

Where the Schrems II risk sits

All Perplexity processing occurs on US-based infrastructure. Even if Perplexity were to offer a DPA tomorrow, the international-transfer analysis would need to address EEA-to-US data flows under Chapter V of the GDPR.

Without a DPA, there is no mechanism for incorporating the Standard Contractual Clauses or any other Chapter V transfer mechanism. The transfer from an EU controller's device to Perplexity's US servers occurs without a lawful transfer mechanism — a direct violation of Articles 44–46 for any personal data included in the query.

What European teams can use instead

The gap in Perplexity's GDPR posture does not mean European teams cannot use AI-assisted research tools. The options that currently meet the DPA minimum:

For general AI assistance: ChatGPT Enterprise or API (OpenAI Ireland Limited DPA), Claude for Work or API (Anthropic DPA), Google Workspace Gemini or Vertex AI (Google Cloud DPA), Microsoft 365 Copilot (Microsoft Online Services DPA). All four offer signed DPAs, SCC-based transfer mechanisms, and training exclusions.

For AI-assisted web research specifically: Microsoft Copilot with Bing (covered by Microsoft's Online Services DPA for commercial accounts), Google Workspace with Gemini's web grounding feature (covered by Google Workspace DPA), Perplexity Enterprise Pro when it reaches sufficient GDPR maturity (not yet as of 2026).

For the personal-data-in-query problem specifically: The most effective control is pseudonymising personal data before the query is submitted — replacing identifiable names, identifiers, and contact information with reversible tokens before the prompt reaches any AI service. This converts the GDPR risk from a transfer-mechanism problem into a non-problem: if the data sent to Perplexity (or any other tool) is not personal data, the GDPR's international-transfer rules do not apply to it.

Can Perplexity be used at all by EU teams?

Yes, in two scenarios that do not create GDPR exposure:

Queries with no personal data. Research tasks, market overviews, technology comparisons, regulatory summaries, and similar queries that contain no names, identifiers, or other personal data do not trigger the GDPR's controller-processor framework. The GDPR applies when personal data is processed — if no personal data is in the query, there is nothing to protect. Many Perplexity use cases at work fall into this category if users are deliberate about not including personal identifiers in their queries.

Queries where personal data has been pseudonymised before submission. A user who runs a local-first privacy tool that strips names and identifiers from the prompt before it is submitted can use Perplexity for research tasks even when the underlying research involves named individuals. The tool Perplexity receives contains no personal data; the user's local environment holds the tokenisation map needed to interpret the result.

These two scenarios cover a substantial proportion of Perplexity's genuine work utility — the research, retrieval, and synthesis use cases — without requiring a DPA that Perplexity does not currently offer.

Frequently asked questions

Why doesn't Perplexity offer an enterprise DPA?

Perplexity has focused primarily on consumer and prosumer markets since launch. As of 2026, enterprise GDPR infrastructure (DPA, sub-processor disclosure, EU-specific data handling) has not been part of its product roadmap in the way it has for OpenAI, Anthropic, Google, and Microsoft. This may change as enterprise procurement becomes a larger part of Perplexity's market, but as of the date of this guide, the gap exists.

Is Perplexity Enterprise Pro GDPR compliant?

Perplexity launched an Enterprise Pro tier in 2024. As of 2026, it includes features like private indices and team management but does not include a fully executed GDPR-compliant DPA with Standard Contractual Clauses, sub-processor disclosure, and data-subject-rights assistance obligations. Verify the current state of Perplexity's enterprise documentation before any deployment — the product is evolving.

Can we use Perplexity for research that involves public figures?

Data about public figures is personal data under the GDPR. Whether processing it requires the full controller-processor framework depends on whether the organisation is acting as a data controller in that processing (almost always yes in a business context). Using Perplexity to research a public figure as part of a commercial, legal, or compliance activity is processing personal data and triggers the Article 28 requirement.

What about Perplexity's use of personal data for training or personalisation?

Perplexity's privacy policy describes personalisation based on query history. Whether this constitutes using personal data to train models depends on the specific feature and implementation. The absence of a DPA means EU controllers cannot contractually restrict Perplexity's use of query content — a further reason the current posture is not suitable for regulated data.

Is there a GDPR-compliant way to get AI-assisted web search?

Yes. Microsoft Copilot for commercial accounts uses Bing retrieval under Microsoft's Online Services DPA and SCCs. Google Workspace Gemini with web grounding operates under the Google Workspace DPA. For in-house builds, Retrieval-Augmented Generation (RAG) systems using a private search index can be configured with full DPA coverage over every component.

The bottom line

Perplexity AI in 2026 is an excellent tool for queries that do not involve personal data. For European teams with regulated workflows — legal, healthcare, financial, HR — Perplexity is not currently a viable option for prompts containing personal data of EU data subjects, because the foundational GDPR requirement of a signed Article 28 DPA is not met.

The practical path is twofold: use Perplexity only for queries that contain no personal data, and use a local-first privacy layer to strip personal identifiers from queries before they are submitted. For all other AI-assisted work involving personal data, choose a provider that currently offers a GDPR-compliant DPA — of which there are now several strong options across the major AI providers.

Related GDPR guides

• GDPR and AI: A 2026 Compliance Guide for European Teams
• Is ChatGPT GDPR Compliant?
• Is Claude GDPR Compliant?
• Is Gemini GDPR Compliant?
• Is Grok GDPR Compliant?
• GDPR Data Subject Rights and AI