Is Zendesk AI GDPR compliant?

Yes

Zendesk · Customer support

Yes. Zendesk offers a Data Processing Agreement (DPA) for Zendesk AI, the baseline GDPR control when a vendor processes personal data on your behalf.

What we checked

This assessment separates the consumer product from any business plan. It uses the vendor documents linked below; an unverified item is not a pass.

Data Processing Agreement: Confirmed; Zendesk publishes a DPA. A DPA is necessary but does not replace your own lawful-basis, DPIA and transfer assessment.
EU data residency: Confirmed; Zendesk documents an EU data-residency option; confirm it is enabled for the account and workload in scope.
Default data training: Opt-out required; Zendesk trains AI functionality on Service Data by default (most customers instruct Zendesk to train); opt out by contacting support to exclude your subdomains. Integrated third-party LLMs never train on customer data.
Business-tier training: Opt-out required; Suite Enterprise plus the Advanced Compliance (HIPAA) and Data Center Location (residency) add-ons is the business tier recorded for this profile.

Practical risk: Zendesk holds SOC 2 Type II and ISO 27001 and 42001 and will sign a BAA via a paid add-on, but it trains its own AI on Service Data by default; you must contact support to opt out, and EU residency and HIPAA are both paid add-ons.

How to make a decision

Check the precise account tier, written contract and intended data before approving Zendesk AI. A security certification, DPA or setting can apply to only part of a vendor's service. Keep the source links with your supplier review and revisit them when the vendor changes its terms.

More on Zendesk AI

Is Zendesk AI HIPAA compliant?Is Zendesk AI SOC 2 compliant?Is Zendesk AI ISO 27001 certified?Does Zendesk AI train on your data?

See the full Zendesk AI risk profile, with every data-handling fact and its source, or browse all rated AI tools.