Data
GDPR MongoDB Atlas
In an indie stack, MongoDB Atlas is used for Managed document database. Entity cited: MongoDB, Inc. (importer of the standard contractual clauses, for itself and its affiliates outside the EEA). The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 5, 2026. Verified on October 5, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA MongoDB Atlas
Yes. Public Data Processing Agreement (stated last update: 21 October 2024), incorporated into the cloud terms. Transfers outside an adequate country: the DPA says that MongoDB participates in the Data Privacy Framework, and incorporates the standard contractual clauses (Decision 2021/914) when the transfer requires it.
Stated role
The DPA states that MongoDB is processor and that the customer may be controller or processor of Customer Personal Data uploaded to the Cloud Services.
Personal data
The DPA covers any Customer Personal Data uploaded to the Cloud Services. Data subjects may include the customer's customers, employees, suppliers, and end users, or any person whose data is uploaded. A more closed list of categories: not disclosed.
Sub-processors of MongoDB Atlas
Public list. For hosting of uploaded data, it names Amazon Web Services, Inc., Google LLC, and Microsoft Corp. Affiliates, including MongoDB, Inc. (United States) and MongoDB France SARL, may process Customer Personal Data for support. The full table is not copied here.
Transfers outside the EU
Hosting / location
The DPA states that the customer chooses the deployment region or regions where Customer Personal Data physically resides. Optional features may result in a transfer outside the EEA, Switzerland, or the United Kingdom. The Atlas documentation publishes the AWS, Google Cloud, and Azure regions, and states that the choice of provider and region is that of the cluster. The exhaustive list is not copied here.
EU–United States Data Privacy Framework
The DPA asserts participation in the EU-U.S. Data Privacy Framework, the United Kingdom extension, and the Swiss-U.S. DPF. Official search for “MongoDB” and “MongoDB, Inc.” on the list on 5 October 2026: no participant. Status on the list: not disclosed.
Cookies
not disclosed
Typical use, written by StackLégal and not by the vendor: Managed document database.
History
Last update: October 5, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 5, 2026.
Frequently asked questions
Is MongoDB Atlas a processor within the meaning of the GDPR?
The DPA states that MongoDB is processor and that the customer may be controller or processor of Customer Personal Data uploaded to the Cloud Services.
What DPA does MongoDB Atlas publish?
Yes. Public Data Processing Agreement (stated last update: 21 October 2024), incorporated into the cloud terms. Transfers outside an adequate country: the DPA says that MongoDB participates in the Data Privacy Framework, and incorporates the standard contractual clauses (Decision 2021/914) when the transfer requires it. https://www.mongodb.com/legal/data-processing-agreement
Which further sub-processors does MongoDB Atlas publish?
Public list. For hosting of uploaded data, it names Amazon Web Services, Inc., Google LLC, and Microsoft Corp. Affiliates, including MongoDB, Inc. (United States) and MongoDB France SARL, may process Customer Personal Data for support. The full table is not copied here. https://www.mongodb.com/products/platform/trust/subprocessors
Where does MongoDB Atlas state that it processes data, including outside the EU?
The DPA states that the customer chooses the deployment region or regions where Customer Personal Data physically resides. Optional features may result in a transfer outside the EEA, Switzerland, or the United Kingdom. The Atlas documentation publishes the AWS, Google Cloud, and Azure regions, and states that the choice of provider and region is that of the cluster. The exhaustive list is not copied here.
Is MongoDB Atlas registered under the EU–United States Data Privacy Framework?
The DPA asserts participation in the EU-U.S. Data Privacy Framework, the United Kingdom extension, and the Swiss-U.S. DPF. Official search for “MongoDB” and “MongoDB, Inc.” on the list on 5 October 2026: no participant. Status on the list: not disclosed.
Which personal data does MongoDB Atlas mention?
The DPA covers any Customer Personal Data uploaded to the Cloud Services. Data subjects may include the customer's customers, employees, suppliers, and end users, or any person whose data is uploaded. A more closed list of categories: not disclosed.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.