Perplexity AI
Perplexity
Assessment labels are editorial guidance, not GDPR certifications. Validate the exact plan, lawful basis, DPA, subprocessors, retention, residency and feature settings. EU storage and no-training terms alone do not establish GDPR compliance. ¹ No training applies under the reviewed plan’s terms.
Pricing / Contract Route
Consumer and Enterprise pricing varies; verify current order form
Enterprise Features
Enterprise no-training, third-party provider zero-retention terms, custom session retention for eligible organisations, Sonar ZDR
Last Updated
September 10, 2026
Reviewed on 10 September 2026 by WAIMAKERS B.V.
1 Purpose
Perplexity documents materially different handling for consumer accounts, Enterprise and the Sonar API. Business use can be considered only route by route. Public documentation reviewed for this assessment did not establish a general EU data-residency commitment, so residency must be confirmed in the contract rather than inferred from European availability or partnerships.
2 Comparison of Perplexity AI routes (EU focus)
| Route | Training use | Retention | Practical assessment |
|---|---|---|---|
| Free, Pro and Max | “AI Data Retention” is enabled by default. Users can opt out for future training; the opt-out does not remove data already used for training. | Account and service records follow the privacy policy and feature-specific rules. | Keep personal and confidential business data out unless the organisation has approved the consumer route. |
| Enterprise | Perplexity says Enterprise data is never used to train its models. It also says third-party model providers are contractually subject to zero retention and no training. | Session attachments are retained for seven days. Files saved to My Files or Projects remain until removed. Eligible organisations can set custom session retention. | Viable conditional route after DPA, residency, provider chain and retention are confirmed. |
| Sonar API | Perplexity documents strict ZDR: prompts and responses are not retained or used for training; only billing metadata such as token count, model, time and API-key identifier is kept. | Zero retention for prompt/response content according to the API privacy page. | Stronger route for controlled applications, subject to DPA, transfer and metadata assessment. |
3 Is Perplexity AI GDPR-compliant?
Perplexity's data-collection notice, updated 16 July 2026, states that consumer AI Data Retention is on by default and that an opt-out affects future training only. The same notice says Enterprise data is never used to train models and describes zero-retention/no-training agreements with third-party model providers.[1]
The Enterprise retention page, updated 2 September 2026, says session attachments are kept for seven days. Custom retention for session data is available to organisations with at least 50 Enterprise Pro seats or one Enterprise Max seat; saved files and Projects are governed separately.[2]
The Sonar API privacy page states that prompt and response content is not retained and is not used for training, while limited billing metadata is retained.[3]
4 Rights, retention and transfers
Perplexity's GDPR help page describes access, deletion and other rights and says an account-deletion request may take up to 30 days, with limited retention where required for legal or legitimate business purposes.[4]
These rights controls and vendor assurances do not create a blanket GDPR finding. A controller still needs a lawful basis, transparency to users, data minimisation, a DPA where Perplexity is a processor, transfer safeguards, a subprocessor review and a response process for sources or generated answers that contain personal data.
5 Data processing flow
The selected account and feature determine which Perplexity service, external model provider, search provider, storage layer and logs receive data. Map that chain before approval.
6 Recommendations and EU rollout checklist
Before approving Enterprise or Sonar:
- Obtain the current DPA and subprocessor list.
- Obtain a written location commitment for prompts, files, indexes, logs, backups and support access.
- Identify each external model or search provider used by the selected feature.
- Set and test session, attachment, saved-file and account deletion separately.
- Disable consumer training where consumer accounts remain permitted.
- Define rules for sensitive queries, source citations and personal-data correction.
Plan names, prices, model menus and query limits change frequently. Verify them on Perplexity's live pricing and order pages rather than copying them into a privacy conclusion.[5]
7 Verdict summary
Perplexity merits a deployment-specific review. Enterprise and Sonar publish valuable no-training controls, and Sonar documents ZDR, while consumer training is enabled by default. EU residency was not confirmed in the reviewed public materials and must be made explicit in procurement.
Disclaimer
This is an editorial procurement assessment, not a legal determination or legal advice.