ModelCharter

Is Canva Magic Studio GDPR compliant?

Yes

Canva Pty Ltd · Design

Yes. Canva Pty Ltd offers a Data Processing Agreement (DPA) for Canva Magic Studio, the baseline GDPR control when a vendor processes personal data on your behalf.

What we checked

This assessment separates the consumer product from any business plan. It uses the vendor documents linked below; an unverified item is not a pass.

Data Processing Agreement
Confirmed
Canva Pty Ltd publishes a DPA. A DPA is necessary but does not replace your own lawful-basis, DPIA and transfer assessment.
EU data residency
Not verified
No EU-residency option was confirmed in the sources reviewed for this profile.
Default data training
Opt-out required
Disputed: Canva officially states training is opt-in (off by default) for Free/Pro, but multiple third-party reports describe AI-training toggles enabled by default that users must turn off; treat as opt-out and verify in current account privacy settings.
Business-tier training
No by default
For Teams, Business, Enterprise and Education accounts Canva states content is never used for AI training and cannot be opted in.
Practical risk: There is a genuine discrepancy between Canva's stated opt-in default and third-party reports of training toggles being on by default for Free/Pro accounts, so an at-work individual user should explicitly verify and disable both 'usage' and 'content' AI-training toggles in privacy settings.

How to make a decision

Check the precise account tier, written contract and intended data before approving Canva Magic Studio. A security certification, DPA or setting can apply to only part of a vendor's service. Keep the source links with your supplier review and revisit them when the vendor changes its terms.

More on Canva Magic Studio

See the full Canva Magic Studio risk profile, with every data-handling fact and its source, or browse all rated AI tools.