Synthesia and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. Synthesia states it does not use customer inputs or outputs to pre-train its AI; fine-tuning on customer data happens only on the customer's written instruction.

Vendor's wording: “Synthesia does not use Customer Data, including inputs or outputs, to pre-train its AI Components.”

Source: synthesia.ioTraining, Data and Provenance > No Customer DataChecked on 19 October 2026

European Union: Customer Data is stored in AWS data centres in Ireland; operational backups in Ireland, secondary backups in AWS Frankfurt.

Vendor's wording: “Customer Data is currently stored within the European Union (EU), in data centers based in Ireland.”

Source: synthesia.ioData location / storageChecked on 19 October 2026

No EU hosting.

EU storage (Ireland) is the default; the security page describes no separate setting to choose. It also says some data transfers to the USA run under Standard Contractual Clauses.

Vendor's wording: “Customer Data is currently stored within the European Union (EU), in data centers based in Ireland.”

Source: synthesia.ioData location / storageChecked on 19 October 2026

DPA on request.

Yes. A Data Processing Addendum is published, and the Customer Terms of Service incorporate it by reference; a signed copy can be executed through a link on the DPA page.

Vendor's wording: “Synthesia offers a Data Processing Addendum that supplements the Customer Terms of Service or any main online subscription agreement.”

Source: synthesia.ioData Processing Agreement pageChecked on 19 October 2026

Published.

Yes, public at https://www.synthesia.io/legal/subprocessors: 33 entries (4 affiliates, 6 infrastructure, 12 script processing, 9 asset processing, 2 other). AI providers named include OpenAI, Anthropic, Google Cloud, Microsoft, ElevenLabs, DeepL, Runway, BFL, BytePlus.

Vendor's wording: “Synthesia uses the third party entities below (each, a “sub-processor”) to process personal data on behalf of Synthesia Customers”

Source: synthesia.ioSub-processors pageChecked on 19 October 2026

UK (EU adequacy).

Not applicable (UK-based vendor, Synthesia Limited, London)

Vendor's wording: “We are Synthesia Limited, a company located at 20 Triton St, London NW1 3BF, United Kingdom”

Source: synthesia.ioIntroductionChecked on 19 October 2026

Customer content is kept under the customer's instructions and retention settings. On a deletion request or account termination it is deleted within up to 90 days (automatically if no request); backups may linger briefly.

Vendor's wording: “If no deletion request is made after account termination, Customer Data will be automatically deleted within 90 days.”

Source: synthesia.ioDeletion of Customer DataChecked on 19 October 2026

3: ISO 42001, ISO 27001 and SOC 2 Type II (periodic audits).

Vendor's wording: “Synthesia undergoes a periodic ISO 42001, ISO 27001, and SOC2 Type II audit.”

Source: synthesia.ioAuditing / complianceChecked on 19 October 2026

Yes in general: Synthesia states customers can enable or disable AI-assisted generation of content. The page names no plan restriction and no admin role for the setting.

Vendor's wording: “Content generation: Customers can enable or disable the use of AI-assisted generation of content.”

Source: synthesia.ioShared responsibility: Content generationChecked on 20 October 2026