Groq: DPA, subprocessors and data location
Where to find the Groq DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: llm inference api (groqcloud). The table is the short version; the sections below add detail.
Groq at a glance
| DPA and how it is accepted | |
|---|---|
| Subprocessor list | |
| Notice of new subprocessors | |
| Objection window and remedy | Window: 15 days Details on objecting |
| Data regions |
|
| Transfer mechanism |
|
| Vendor role | Processor: it handles your customers' data on your instructions. Details on its role |
| Checked on | (the oldest check date of any fact on this page) |
Notes on Groq
Groq's DPA (effective October 15, 2025) is accepted together with the Services Agreement, with no separate signature.
The 15 days' notice of subprocessor changes reaches you only if you subscribe to email notifications on the list website, and you have 15 days to object (section 7.2). If Groq has no workaround, you may suspend or terminate the affected Cloud Services.
Section 8.1 allows processing in the United States and other countries where Groq or its subprocessors operate, and Groq's data docs say retained customer data sits in US Google Cloud buckets. The DPA names the SCCs and does not mention the Data Privacy Framework.
Groq DPA: where to find it and how it is accepted
Read the DPA on console.groq.com. Your electronic acceptance of the Services Agreement constitutes your signature to the DPA (Annex I). The page is titled "Data Processing Addendum for GroqCloud Services" and shows Effective: October 15, 2025..
Source: console.groq.com, checked 2026-10-17Not stated in the source we checked (2026-10-17).
The DPA applies to the Agreement and the Cloud Services and does not list plans.
Source: console.groq.com, checked 2026-10-17Groq subprocessors: the list and how change notices reach you
Source: console.groq.com, checked 2026-10-17How changes are announced: Email, posting on the Subprocessor List website, or notification in Console, for customers who subscribe (section 7.2).
Source: console.groq.com, checked 2026-10-17Notice before a new subprocessor starts: 15 days.
Section 7.2: only if you subscribe to email notifications on the Subprocessor List website, Groq notifies you of intended changes at least 15 days before they take effect, by email, a posting on the list website, a notification in Console or other reasonable means.
Source: console.groq.com, checked 2026-10-17You can object within 15 days. Groq uses commercially reasonable efforts to offer a change in the Cloud Services or a recommended change in your use to avoid the objected-to subprocessor. If it cannot, you may suspend or terminate the affected Cloud Services at your sole discretion (section 7.2).
Section 7.2: object in writing within 15 days of the notice, on reasonable grounds relating to data protection.
Source: console.groq.com, checked 2026-10-17Source: console.groq.com, checked 2026-10-17Where Groq stores data
- United States
DPA section 8.1: Groq may process Personal Data in the United States and other countries where it or its subprocessors maintain processing operations. Groq's "Your Data" docs page says all customer data is retained in Google Cloud Platform buckets located in the United States. Neither page names specific data centers or a region choice.
Source: console.groq.com, checked 2026-10-17How Groq moves data outside the EU and UK
- SCCs (Modules 2 and 3)
- UK Addendum
- Swiss FADP modifications
- Saudi PDPL clauses
Section 8.2: the parties are deemed to have signed the EU SCCs, Module 2 for controller-to-processor and Module 3 for processor-to-sub-processor, with Option 2 (general written authorization) in Clause 9. Section 8.3 adds the UK Addendum, section 8.4 the Swiss FADP changes and section 8.5 the Saudi PDPL clauses. The DPA text does not mention the Data Privacy Framework.
Source: console.groq.com, checked 2026-10-17Is Groq a processor or a controller?
Processor: it handles your customers' data on your instructions.
Section 2.1: you are a controller or processor and Groq is a processor or sub-processor for the Personal Data it processes to provide the Cloud Services.
Source: console.groq.com, checked 2026-10-17Is Groq GDPR compliant?
We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Groq's own documents say:
- A DPA is published: Your electronic acceptance of the Services Agreement constitutes your signature to the DPA (Annex I). The page is titled "Data Processing Addendum for GroqCloud Services" and shows Effective: October 15, 2025.
- A subprocessor list is published.
- Notice of new subprocessors: 15 days. Section 7.2: only if you subscribe to email notifications on the Subprocessor List website, Groq notifies you of intended changes at least 15 days before they take effect, by email, a posting on the list website, a notification in Console or other reasonable means.
- Transfer mechanisms named: SCCs (Modules 2 and 3), UK Addendum, Swiss FADP modifications, Saudi PDPL clauses.
- Data locations named: United States.
What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.
Add Groq to your own subprocessor list
This row uses the facts above. Change the purpose to match how you use Groq, then paste it into your list, or open it in the generator to add your other vendors.
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
|---|---|---|---|---|---|
| Groq | LLM inference API (GroqCloud) | United States | SCCs (Modules 2 and 3); UK Addendum; Swiss FADP modifications; Saudi PDPL clauses | DPA | List |
Same row as Markdown
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Groq | LLM inference API (GroqCloud) | United States | SCCs (Modules 2 and 3); UK Addendum; Swiss FADP modifications; Saudi PDPL clauses | [DPA](https://console.groq.com/docs/legal/customer-data-processing-addendum) | [Subprocessors](https://trust.groq.com/subprocessors) |
If you add or replace Groq: what to tell your customers
Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.
Groq states 15 days of notice before it adds a subprocessor. Section 7.2: only if you subscribe to email notifications on the Subprocessor List website, Groq notifies you of intended changes at least 15 days before they take effect, by email, a posting on the list website, a notification in Console or other reasonable means. If your own customers were promised a longer notice, you have a gap to plan for.
Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.
What changed
- First check: facts recorded from Groq's own DPA (effective October 15, 2025) and its data docs. The subprocessor list could not be read as text.
Related vendors
Sources and method
- https://console.groq.com/docs/legal/customer-data-processing-addendum checked 2026-10-17
- https://trust.groq.com/subprocessors checked 2026-10-17
- https://console.groq.com/docs/your-data checked 2026-10-17
Facts come from Groq's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: groq.com.