Synthesia GDPR: Training, DPA & German Compliance Facts
Does Synthesia train on customer content — and is it GDPR compliant?
No. Synthesia does not use customer content — inputs or outputs — to pre-train its AI components, and fine-tuning on your data requires your written instruction. It offers an Art. 28 Data Processing Addendum and stores customer data in the EU (AWS Ireland), so German companies can deploy it in a GDPR-compliant setup.
- No training on customer content: Synthesia states it does not use Customer Data, inputs or outputs, to pre-train its AI components.
- Any fine-tuning of AI components that processes customer data requires the customer's written instruction under the governing agreement.
- GDPR facts: Art. 28 Data Processing Addendum available; customer data stored in the EU on AWS in Ireland, secondary backups in Frankfurt.
- German rollouts still need a legal-basis check and works council engagement under §87 BetrVG where employees are affected.
No — Synthesia does not train on customer content. Synthesia’s AI Governance Practices state plainly that it “does not use Customer Data, including inputs or outputs, to pre-train its AI components.” And Synthesia is GDPR-usable for German companies: the company offers an Article 28 GDPR Data Processing Addendum (DPA) and stores customer data in the EU, on AWS infrastructure in Ireland. No tool is “GDPR compliant” as a badge — compliance depends on your use — but the facts that matter for a German deployment are verifiable and set out below. Our AI tools guide covers the full range of AI video and media tools reviewed for enterprise use in Germany.
Verified: October 2026, from Synthesia’s documents: Customer Terms of Service (effective July 20, 2026), Data Processing Agreement page (updated July 22, 2026), AI Governance Practices, and Security Practices (updated February 3, 2026).
Does Synthesia train on customer content?
No. Synthesia does not use Customer Data — your inputs or your generated outputs — to pre-train its AI components.
The nuance matters for vendor reviews. Synthesia pre-trains its avatar models on performances by paid actors it commissions, performances made public, and licensed material — not on customer scripts or videos. Where processing of customer data would result in fine-tuning of AI components, the customer’s written instruction is required under the governing agreement. The Customer Terms reinforce this: usage information may be used to improve the Services, but never to fine-tune AI components beyond those integrated in your own tenant, and never to create standalone AI models.
Is Synthesia GDPR compliant for German companies?
GDPR does not certify products — it applies to your processing, with Synthesia as processor and your organisation as controller. What can be verified are the building blocks a German deployment needs, and Synthesia documents them:
| GDPR fact | Status (verified October 2026) |
|---|---|
| Training on customer content | No — inputs and outputs excluded from pre-training |
| Fine-tuning on customer data | Only on the customer’s written instruction |
| DPA (AVV equivalent) | Art. 28 Data Processing Addendum, incorporated into the Customer Terms |
| Data storage | EU — AWS Ireland; secondary backups in AWS Frankfurt |
| Third-country transfers | SCCs via AWS DPA; transfer impact assessment published |
| Deletion | Within up to 90 days of request or termination |
| Certifications | SOC 2 Type II, ISO 27001, ISO/IEC 42001 audits |
Two honest caveats. First, the contracting entity for European customers is Synthesia Limited, a UK-incorporated company contracting under Irish law — the DPA and SCC framework govern the transfer mechanics, but if your vendor policy requires an EU-incorporated processor, check this point in procurement. Second, executing the DPA, defining your legal basis, and documenting data categories remain your tasks — they do not happen automatically. AI video generation compliance and AI voice assistant compliance explain the specific AI Act obligations for synthetic avatars and voices.
EU AI Act: your role as deployer
Under the EU AI Act, your obligations depend on how you use Synthesia. When you use the Services, your organisation takes the deployer role and Synthesia acts as the provider. General productivity and training-video use typically falls under minimal or limited risk; Synthesia states that its AI components, used as intended and per its Acceptable Use Policy, are not high-risk AI systems to its knowledge.
Transparency still matters: freemium videos carry watermarks by default, and paying customers can embed audio or visual disclosure markers — relevant for synthetic media obligations under Article 50. Sector-specific requirements for AI-generated training and corporate content are covered in the media and entertainment AI compliance guide.
Works council requirements
If Synthesia affects how employees work in Germany, the Betriebsrat may have co-determination rights under §87 BetrVG. This is especially relevant if the tool could monitor activity, affect performance evaluation, or significantly change work processes.
Engage your works council early — explain the tool, address concerns, and agree on appropriate use policies.
What This Means Practically
For most German businesses, Synthesia is deployable with proper preparation: execute the DPA, confirm the EU storage setup matches your requirements, assess your legal basis, engage the works council if employees are affected, train employees on appropriate use, and document your compliance approach.
How Compound Law Helps
- Deployment assessment for Synthesia
- DPA review and gap analysis
- Works council coordination where needed
- Usage policy development
- Ongoing compliance monitoring
This page is general information, not legal advice — specific situations require individual legal counsel.
Frequently Asked Questions
Does Synthesia train on customer content?
No. Synthesia’s AI Governance Practices state that it does not use Customer Data, including inputs or outputs, to pre-train its AI components. Pre-training relies on performances by paid actors Synthesia commissions, public performances, and licensed material. Any processing of customer data that results in fine-tuning is subject to the customer’s written instruction under the governing agreement.
Is Synthesia GDPR compliant?
No AI tool is “GDPR compliant” as a badge — GDPR applies to your processing, not to the product. The verifiable facts for a German deployment: Synthesia offers an Art. 28 Data Processing Addendum, stores customer data in the EU on AWS in Ireland, commits not to train on customer content, and holds SOC 2 Type II, ISO 27001, and ISO/IEC 42001 audits. Whether your specific use is compliant depends on your legal basis, data categories, and internal governance — that assessment is case-specific.
Does Synthesia offer a DPA?
Yes. Synthesia publishes a Data Processing Addendum that supplements its Customer Terms of Service, and the Customer Terms incorporate it by reference. When you use the Services, your organisation is the controller and Synthesia acts as processor under GDPR. For European customers the contracting entity is Synthesia Limited, with Irish law and Dublin as the agreed venue.
Where does Synthesia store data?
In the EU. Synthesia’s Security Practices state that customer data is stored on AWS infrastructure in Ireland, with operational backups in Ireland and secondary backups in the AWS Frankfurt region. Transfers from the EU to the USA within AWS services are safeguarded by Standard Contractual Clauses in AWS’s DPA, and Synthesia has published a transfer impact assessment. Deletion happens within up to 90 days of a deletion request or account termination.
Do we need works council approval in Germany?
Possibly. If Synthesia affects how employees work — for example if it could monitor behaviour, influence performance evaluation, or materially change workflows — the works council has co-determination rights under §87 BetrVG. Engage the Betriebsrat early, explain the use case, and agree on a usage policy before rollout.
What about the EU AI Act?
When you use Synthesia, your organisation is the deployer and Synthesia is the provider under the EU AI Act. Synthesia states that its AI components, used as intended and per its Acceptable Use Policy, are not classified as high-risk AI systems to its knowledge. For transparency, freemium videos carry watermarks by default, and paying customers can add audio or visual disclosure markers — relevant for synthetic media under Article 50.
