ElevenLabs: DPA, subprocessors and data location

Where to find the ElevenLabs DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: voice and speech ai. The table is the short version; the sections below add detail.

ElevenLabs at a glance

Notes on ElevenLabs

The ElevenLabs DPA page is dated "Last Updated: 8 April 2026" and gives no effective date. It forms part of the agreement that references it, and the page describes no signature step.

You get at least 30 days' notice of a new subprocessor, delivered only by an update to the Subprocessor List, and 30 days to object (section 6.3). Section 13.1 lets you request a hosting jurisdiction, but availability is at ElevenLabs' discretion and data can still be processed elsewhere by subprocessors, support staff and the moderation team.

Deletion differs by plan. Enterprise Customer Content is deleted within 30 days of the agreement ending, while for self-serve ElevenLabs may delete it after 180 days of inactivity but is not required to (sections 9.2.1 and 9.2.2).

ElevenLabs DPA: where to find it and how it is accepted

Read the DPA on elevenlabs.io. The DPA forms part of the agreement that references or incorporates it. The page describes no click-through or signature step. It says the SCCs are deemed executed when the DPA takes effect (section 11.1)..

Not stated in the source we checked (2026-10-17).

The DPA does not list plans. It treats enterprise customers (section 9.2.1) and self-serve customers (section 9.2.2) differently for deletion of Customer Content.

ElevenLabs subprocessors: the list and how change notices reach you

ElevenLabs's subprocessor list.

How changes are announced: Update to the Subprocessor List at compliance.elevenlabs.io (section 6.3).

Notice before a new subprocessor starts: 30 days.

Section 6.3: ElevenLabs notifies you at least thirty (30) days before appointing a new or replacement subprocessor, by updating the Subprocessor List. The DPA names no email notice.

You can object within 30 days. The parties negotiate in good faith. If that does not resolve it, either party may, within 30 days of the concluded negotiations, terminate the Services that need the subprocessor upon written notice (section 6.3).

Section 6.3: object in writing within the same Notice Period (30 days), on reasonable grounds relating to data privacy or data security.

Where ElevenLabs stores data

• Hosting jurisdiction on request, at ElevenLabs' discretion

Section 13.1: "In certain instances" you may request that Customer Personal Data be hosted in a particular jurisdiction where ElevenLabs offers data storage, and availability "is subject to ElevenLabs' discretion". The DPA names no jurisdictions. Even with a chosen residency, data may still be processed elsewhere by subprocessors, support staff and the moderation team (sections 13.1.1 to 13.1.3).

How ElevenLabs moves data outside the EU and UK

• DPF (named as an adequacy basis)
• EEA SCCs
• UK Addendum
• Swiss FADP modifications
• Brazil SCCs

Section 11.1 authorizes transfers to adequate countries "including on the basis of the EU-US Data Privacy Framework", under the SCCs, or on other adequate safeguards. The DPA does not state whether ElevenLabs itself participates in it. It refers to the controller-to-processor or processor-to-processor module without numbering them, with Irish law and courts (section 11.2), the UK Addendum (11.4), Swiss modifications (11.3) and Brazil SCCs (11.5).

Is ElevenLabs a processor or a controller?

Processor: it handles your customers' data on your instructions.

Section 2.1: the DPA applies to the extent ElevenLabs processes Customer Personal Data as a processor on behalf of the customer.

Is ElevenLabs GDPR compliant?

We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what ElevenLabs's own documents say:

• A DPA is published: The DPA forms part of the agreement that references or incorporates it. The page describes no click-through or signature step. It says the SCCs are deemed executed when the DPA takes effect (section 11.1).
• A subprocessor list is published.
• Notice of new subprocessors: 30 days. Section 6.3: ElevenLabs notifies you at least thirty (30) days before appointing a new or replacement subprocessor, by updating the Subprocessor List. The DPA names no email notice.
• Transfer mechanisms named: DPF (named as an adequacy basis), EEA SCCs, UK Addendum, Swiss FADP modifications, Brazil SCCs.
• Data locations named: Hosting jurisdiction on request, at ElevenLabs' discretion.

What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.

Add ElevenLabs to your own subprocessor list

This row uses the facts above. Change the purpose to match how you use ElevenLabs, then paste it into your list, or open it in the generator to add your other vendors.

| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| ElevenLabs | Voice and speech AI | Hosting jurisdiction on request, at ElevenLabs' discretion | DPF (named as an adequacy basis); EEA SCCs; UK Addendum; Swiss FADP modifications; Brazil SCCs | [DPA](https://elevenlabs.io/dpa) | [Subprocessors](https://compliance.elevenlabs.io) |

Add to my list

If you add or replace ElevenLabs: what to tell your customers

Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.

ElevenLabs states 30 days of notice before it adds a subprocessor. Section 6.3: ElevenLabs notifies you at least thirty (30) days before appointing a new or replacement subprocessor, by updating the Subprocessor List. The DPA names no email notice. If your own customers were promised a longer notice, you have a gap to plan for.

Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.

What changed

2026-10-17

First check: facts recorded from ElevenLabs' own DPA page (last updated 8 April 2026). The subprocessor list could not be read as text.

2026-10-17

Re-checked sections 6.3, 11.1 and 13.1 against the raw DPA text; no value changes. 6.3: 30 days' notice given "by updating the Subprocessor List", objection within the Notice Period, either party may terminate within 30 days of the concluded negotiations. 11.1/11.2: DPF named as an adequacy basis, controller-to-processor or processor-to-processor module, Irish law. 13.1: residency is available only "in certain instances" and at ElevenLabs' discretion. Notes sharpened.

Related vendors

• AI and LLM APIs
• OpenAI LLM API
• Anthropic LLM API (Claude)
• Gemini API LLM API (Google)
• Groq LLM inference API (GroqCloud)
• Mistral AI LLM API
• OpenRouter LLM routing API
• All vendors

Sources and method

• https://elevenlabs.io/dpa checked 2026-10-17
• https://compliance.elevenlabs.io checked 2026-10-17

Facts come from ElevenLabs's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: elevenlabs.io.