Is Adobe Creative Cloud GDPR compliant? What universities should check
Adobe Creative Cloud is licensed by many universities for design, media and communication courses, and it now ships with Firefly and a growing list of partner AI models. This page sets out what Adobe documents about its role, its AI training terms and its subprocessors, and what a university should confirm before rolling it out to staff and students.
Short answer
Adobe's Data Processing Addendum (June 2024) names the customer as controller and Adobe as processor for cloud services, and routes European personal data through Adobe Systems Software Ireland Limited before onward transfer under the Standard Contractual Clauses. Adobe's terms commit it not to train generative AI on customer content, except content submitted to Adobe Stock. The points to settle are the partner AI models now offered in Adobe apps, the 14-day subprocessor notice, whether education accounts are excluded from content analysis, and where your institution's content is stored.
What Adobe documents publicly
Everything in this table comes from Adobe's own pages, read on 7 October 2026. Adobe's Help Center pages on enterprise storage and content analysis returned access errors on that date, so they are not used here. Numbers in brackets refer to the sources at the end.
| Topic | What the vendor states | Source |
|---|---|---|
| Company and establishment | Documented Adobe Systems Software Ireland Limited is the controller for people in the EEA where Adobe acts as controller. Adobe says it is the processor, not the controller, when enterprise customers such as educational institutions use Adobe products and services to support their own provision of services to individuals. | [1] |
| Data processing agreement | Documented Adobe's Data Processing Addendum (June 2024, cloud services) names the customer as controller and Adobe as processor, limits processing to the purposes in the agreement, offers DPIA assistance and an annual audit right on 60 days' notice, and requires deletion or return of personal data at the end of the term "as further specified under the Agreement". | [3] |
| Where data is processed | Partly documented The DPA says Adobe Ireland is the initial recipient of European personal data and engages subprocessors outside the European Area. For processing where Adobe is controller, the privacy policy names the US and India as main locations. An EU storage option for Creative Cloud for education was not found in the public pages we could load (checked 7 October 2026). | [3], [1] |
| Subprocessors | Documented Public list (last updated 28 September 2026) with Microsoft Azure, Amazon Web Services, Akamai, Cloudflare and Fastly for infrastructure, and generative AI partners including OpenAI, Google, Black Forest Labs, Runway, ElevenLabs and Luma AI. New subprocessors are notified at least 14 days in advance to subscribed addresses, with a right to object. | [4], [3] |
| International transfers | Documented Adobe Ireland, as data exporter, ensures an appropriate transfer mechanism; the DPA defines the 2021 SCCs. The privacy policy states that Adobe complies with the EU-U.S. DPF, the UK Extension and the Swiss-U.S. DPF. The official DPF List search service returned errors on the check date, so we rely on Adobe's statement. | [3], [1] |
| AI training on customer content | Documented The General Terms of Use say Adobe will "not use your Local or Cloud Content to train generative AI models" except content submitted to Adobe Stock. Adobe announced in June 2024 that it would add this commitment to its terms after customers raised concerns about earlier wording. | [2], [6] |
| Content analysis | Plan-dependent Subject to opt-out rights, Adobe may run content analytics on cloud content to improve its services. Whether education accounts are excluded by default was not confirmed in pages we could load (checked 7 October 2026). | [2] |
| Security certifications | Documented Adobe's compliance list includes ISO/IEC 27001:2022 with an organisation-wide scope, ISO 27017, ISO 27018 and SOC 2 Type II reports shared under NDA. The list did not map each certificate to Creative Cloud products. | [5] |
| Students and children | Documented Adobe Express, Creative Cloud and Document Cloud apps are available to students, including children, for educational purposes under the supervision of school personnel. | [1] |
Adobe deserves credit for putting its AI training restriction into its terms rather than a blog post, for naming generative AI partners individually in its subprocessor list with locations, and for offering subprocessor notifications by email.
What this means for a university
Validemic's analysisThe account type decides the legal position. Adobe's DPA treats the institution as controller and Adobe as processor for the cloud services in the institution's agreement [3], [1]. Students who buy their own plan, or staff who sign in with a personal Adobe ID, are customers of Adobe in their own right. Article 28 GDPR requires a contract for processing on the university's behalf [8], so guidance should require institutional accounts for teaching and assessed work.
Check that the DPA reaches your licence. The June 2024 addendum is headed "Cloud Services Only" and defines cloud services by reference to the on-demand and managed services in the customer's agreement [3]. Most universities buy Creative Cloud through a reseller or an enterprise term licence, so the DPO should confirm in writing that the addendum is incorporated into that specific agreement and which version applies.
The 2024 terms episode is worth knowing. In June 2024 a re-acceptance of Adobe's earlier terms raised concerns among customers about what the terms meant. Adobe stated it does not scan content stored locally and said it would add the training restriction to its terms as a legal obligation [6]. That is a real improvement, and it also shows why a university should keep a dated copy of the terms it relied on.
Firefly and partner models are different questions. The training restriction covers Adobe's use of customer content [2]. Partner models from OpenAI, Google and others run as subprocessors [4]. Under the DPA they are bound by obligations no less protective than Adobe's own [3], but the list gives processing locations outside the EU for several of them. A DPO should know whether partner models are enabled for the institution's users and whether admins can turn them off. We could not confirm the admin controls from public pages on the check date.
Fourteen days is short notice. Notice goes only to registered addresses and the objection route ends, at most, in terminating the affected order [3]. Register a shared mailbox, not one person, and add the list to your subprocessor monitoring.
Retention depends on the agreement. The DPA leaves retention and deletion timing to the underlying agreement and the customer's configuration [3]. Find out which agreement your licence sits under (for example a reseller or enterprise term licence) and what deletion period it sets for students who leave.
Transfers. European data enters through Adobe Ireland, with SCCs for onward transfers [3]. Adobe also states DPF participation [1]; the European Commission lists the United States as adequate only for DPF participants [7], and several AI model partners process in countries such as Singapore, Malaysia and Saudi Arabia [4] that need their own transfer assessment.
DPIA. Creative work by students is usually low risk, but projects that include photos, video or voice recordings of identifiable people, or health and identity topics, can raise it. Article 35 GDPR applies where high risk is likely [8].
Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace
Questions to ask Adobe before approving Creative Cloud
- Which agreement and DPA version govern our education licence, and what deletion period applies at the end of the term?
- Are education accounts (Enterprise or Federated ID) excluded from content analysis by default, and can you confirm that in writing?
- Which generative AI partner models are enabled for our users today, and can our administrators disable each one?
- Where is our institution's cloud content stored, and is an EU storage location available for our licence?
- Which of your certifications, such as ISO 27001 and SOC 2 Type II, cover Creative Cloud for education specifically?
- How do students without an institutional account get access, and what do you recommend we tell them?
- Which subprocessors process data for support cases from European customers?
The EU AI Act angle
Firefly and partner models are generative AI features, and a university that enables them is a deployer under Regulation (EU) 2024/1689 [9]. Article 4 on AI literacy has applied since 2 February 2025; the Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, reworded it as a duty to take measures to support staff AI literacy [10]. Creating images or video for teaching is not an Annex III high-risk use; those rules, which apply from 2 December 2027 under the Omnibus, concern uses such as evaluating learning outcomes or admissions [9], [10]. Transparency duties for AI-generated content are worth covering in course guidance.
Sources
- Adobe Privacy Policy (last updated 24 October 2025), retrieved 7 October 2026.
- Adobe General Terms of Use (last updated 3 October 2025), retrieved 7 October 2026.
- Adobe Data Processing Addendum (Cloud Services Only) (June 2024), retrieved 7 October 2026.
- Adobe Cloud Services Sub-Processors (last updated 28 September 2026), retrieved 7 October 2026.
- Adobe Trust Center, Compliance list, retrieved 7 October 2026.
- Adobe Blog, Here's what to know about Adobe's Terms of Use updates (10 June 2024), retrieved 7 October 2026.
- European Commission, Adequacy decisions, retrieved 7 October 2026.
- Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 28 and 35, retrieved 7 October 2026.
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 4 and Annex III, retrieved 7 October 2026.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), retrieved 7 October 2026.
About this page
We read Adobe's privacy policy, General Terms of Use, Data Processing Addendum, subprocessor list, compliance list and the June 2024 terms update on 7 October 2026. Adobe's Help Center returned access errors on that date, and the official Data Privacy Framework List could not be queried. We did not test an Adobe Admin Console or review a customer-specific agreement. "Not found" means we could not find information in public documentation; it does not mean it does not exist.
This page is not legal advice and is not a statement that Adobe Creative Cloud is or is not GDPR compliant, which depends on your contract, configuration and use. If you work at Adobe or spot an error, please contact us and we will correct it.
Frequently asked questions
Does Adobe train Firefly on my students' work?
Adobe's General Terms of Use say Adobe will not use local or cloud content to train generative AI models, except content a user chooses to submit to the Adobe Stock marketplace (checked 7 October 2026). Partner models offered inside Adobe apps are run by third parties listed as subprocessors.
Is Adobe a processor or a controller for a university?
Adobe's privacy policy says Adobe is the data processor, not the controller, when enterprise customers such as educational institutions use Adobe products and services to support their own provision of services to individuals. Its Data Processing Addendum names the customer as controller and Adobe as processor for cloud services. Students using their own personal Adobe accounts are in a different position, with Adobe as controller.
Where does Adobe process data for European customers?
Under Adobe's DPA, personal data from the European Area is received by Adobe Systems Software Ireland Limited, which then uses subprocessors in other countries. The subprocessor list names locations including the US, the EU, the UK, Singapore, Malaysia and Saudi Arabia, depending on the service.
How much notice does Adobe give of new subprocessors?
The June 2024 DPA says Adobe notifies subscribed email addresses at least 14 days before a new subprocessor may process personal data, and customers may object on reasonable grounds. Notifications go only to addresses registered on Adobe's subprocessor page.