Collaboration
GDPR Notion
In an indie stack, Notion is used for Notes, wikis, and team documents. Entity cited: Notion Labs, Inc.. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 4, 2026. Verified on October 4, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Notion
Yes. Public Data Processing Addendum.
Stated role
When the customer is controller or processor, Notion is the processor of the personal data that the customer and its users upload, processed on instruction under the DPA.
Personal data
Name, email, password, role, optional profile photo, IP address, device and browser details, cookie identifiers, general location inferred from the IP, usage data, uploaded content.
Sub-processors of Notion
Trust Center list.
Transfers outside the EU
Hosting / location
Information may be transferred, processed, and stored anywhere in the world, including in the United States. The sub-processor list places AWS for hosting and storage in the United States, the European Union, Korea, and Japan.
EU–United States Data Privacy Framework
Notion Labs, Inc. is registered. Exact EU-U.S. Data Privacy Framework status: Active - Re-certification under Review.
Cookies
Strictly necessary, analytics, and marketing cookies, pixels, and local storage. Marketing cookies are set by advertising partners.
Typical use, written by StackLégal and not by the vendor: Notes, wikis, and team documents.
History
Last update: October 4, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 4, 2026.
Frequently asked questions
Is Notion a processor within the meaning of the GDPR?
When the customer is controller or processor, Notion is the processor of the personal data that the customer and its users upload, processed on instruction under the DPA.
What DPA does Notion publish?
Yes. Public Data Processing Addendum. https://www.notion.so/notion/Data-Processing-Addendum-361b540101274b1fa7e16b90402b0d99
Which further sub-processors does Notion publish?
Trust Center list. https://trust.notion.com/subprocessors
Where does Notion state that it processes data, including outside the EU?
Information may be transferred, processed, and stored anywhere in the world, including in the United States. The sub-processor list places AWS for hosting and storage in the United States, the European Union, Korea, and Japan.
Is Notion registered under the EU–United States Data Privacy Framework?
Notion Labs, Inc. is registered. Exact EU-U.S. Data Privacy Framework status: Active - Re-certification under Review. https://www.dataprivacyframework.gov/participant/6134
Which personal data does Notion mention?
Name, email, password, role, optional profile photo, IP address, device and browser details, cookie identifiers, general location inferred from the IP, usage data, uploaded content.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.