Amazon Q Developer and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. For the Pro tier, AWS says customer content is not used to train any underlying foundation models (the Free tier is different).

Vendor's wording: “For users who access Amazon Q Developer with the Pro Tier, your content is not used to train any underlying FMs.”

Source: aws.amazon.comFAQs, Does Amazon Q Developer use my content to train any models?Checked on 19 October 2026

In the AWS Region where the customer's Q Developer profile was created (US East N. Virginia or Europe Frankfurt), for chat, IDE and command-line features. Other features can be stored and processed in a US Region.

Vendor's wording: “your content is stored in the AWS Region where your Amazon Q Developer profile was created only for the following features”

Source: docs.aws.amazon.comData storage, AWS Regions where content is processed and storedChecked on 19 October 2026

EU hosting available.

Yes. Create the Q Developer profile in Europe (Frankfurt); requests are then stored there, and cross-region inference stays within European Regions. Some features are unavailable in Frankfurt and others can still use the US.

Vendor's wording: “The Amazon Q Developer console and Amazon Q Developer profile are supported in the following Regions: US East (N. Virginia) Europe (Frankfurt)”

Source: docs.aws.amazon.comSupported Regions for the Q Developer console and Q Developer profileChecked on 19 October 2026

DPA in the terms.

Yes. The AWS Data Processing Addendum supplements the AWS Customer Agreement (or other agreement governing use of the services).

Vendor's wording: “supplements the AWS Customer Agreement available at”

Source: d1.awsstatic.comAWS Data Processing Addendum, opening paragraphChecked on 19 October 2026

See details.

Partly. AWS publishes one AWS-wide sub-processor list (aws.amazon.com/compliance/sub-processors/) organised by service; only 'Amazon Q Developer Free Tier' appears, not the Pro tier. No count given because the list is not specific to Q Developer.

Vendor's wording: “Amazon Q Developer Free Tier Kiro Free Tier / Individual Subscriber Canada Germany Netherlands USA”

Source: aws.amazon.comSection 2b, AWS entities providing service improvementChecked on 19 October 2026

On the list.

Active (Amazon.com, Inc. (listing with 5 covered entities); EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Amazon Web Services'Checked on 19 October 2026

SOC 1, SOC 2 and SOC 3 (3 reports): the FAQ says Q Developer is included in the latest SOC reports, available through AWS Artifact. No other certification is named for Q Developer.

Vendor's wording: “Amazon Q Developer is included in the latest SOC 1/2/3 reports.”

Source: aws.amazon.comFAQs, Is Amazon Q Developer included in AWS’s latest SOC report?Checked on 19 October 2026

Yes. AWS administrators can allow or deny Amazon Q Developer, or limit it to EU Regions, for the organisation using IAM and service control policies. For Pro, admins also set the code-reference filter centrally.

Vendor's wording: “You can also use service control policies (SCPs) to control what Amazon Q features are available in your”

Source: docs.aws.amazon.comManage access to Amazon Q Developer with policiesChecked on 19 October 2026