Framework
GDPR Next.js
Next.js is the framework. It is not the vendor that hosts your users’ data, and this page assigns it neither a DPA nor a processor list. You do not name it as a processor. You name the host that runs the application, and the other providers that see data.
Published on 5 October 2026. This is not legal advice. A fact that is not on a vendor page stays “not disclosed”.
Next.js DPA
Not disclosed, and that is not a missing entry: Next.js is not presented here as a party to an Article 28 agreement. The DPA to read is the host’s. For a Vercel deployment, start from the GDPR Vercel entry.
Processors to name instead
A common Next.js stack crosses hosting, the database, authentication, email and payment. Each has its own entry.
Transfers outside the EU
The transfer depends on the vendor, not on the framework. Vercel states primary facilities in the United States and a Data Privacy Framework registration. Supabase is not registered: if you chose a region, write it. Stripe transfers to Stripe, LLC in the United States. The detail, with the check date, is on each entry — not here.
Next.js, Vercel and Stripe stack · Supabase, Resend and Stripe stack
Frequently asked questions
Is Next.js a processor under the GDPR?
No, for the purpose of this page. Next.js is the application framework. It is not a vendor that processes personal data on your behalf. This page assigns it neither a DPA, nor a processor list, nor a Data Privacy Framework registration: those points are not disclosed, because they do not apply to a framework. You name the host that runs the application.
What should you declare for a Next.js SaaS?
You remain the controller. The processors section names the vendors that see data: often Vercel for hosting, Stripe for payment, and, depending on the stack, Supabase, Clerk or Resend. Each entry has its own check date.
Where is the data of a Next.js application hosted?
Next.js does not publish a hosting location: it does not operate the servers. The location is the host’s. For Vercel, the entry states primary facilities in the United States. Write the project’s real host, not the framework’s name.
Full pack, from 39 € incl. VAT
StackLégal generates the legal notice, terms of use, terms of sale, privacy policy, Article 28 DPA and the public list, citing only the boxes you tick. Next.js is not named as a processor. One-time payment via Gumroad. This is not legal advice.