Is Notion AI GDPR compliant?

Yes

Notion Labs, Inc. · Productivity

Yes. Notion Labs, Inc. offers a Data Processing Agreement (DPA) for Notion AI, the baseline GDPR control when a vendor processes personal data on your behalf.

What we checked

This assessment separates the consumer product from any business plan. It uses the vendor documents linked below; an unverified item is not a pass.

Data Processing Agreement: Confirmed; Notion Labs, Inc. publishes a DPA. A DPA is necessary but does not replace your own lawful-basis, DPIA and transfer assessment.
EU data residency: Not verified; No EU-residency option was confirmed in the sources reviewed for this profile.
Default data training: No by default; Notion states that by default neither it nor its AI subprocessors use Customer Data to train any models, across all plan tiers.
Business-tier training: No by default; Notion has contractual agreements prohibiting its AI subprocessors from training on Customer Data, and your use of Notion AI grants Notion no license to train ML models on your data.

Practical risk: Some AI features can optionally enable data-retaining LLMs via workspace settings, so an admin must confirm the workspace stays on zero/short-retention configurations.

How to make a decision

Check the precise account tier, written contract and intended data before approving Notion AI. A security certification, DPA or setting can apply to only part of a vendor's service. Keep the source links with your supplier review and revisit them when the vendor changes its terms.

More on Notion AI

Is Notion AI HIPAA compliant?Is Notion AI SOC 2 compliant?Is Notion AI ISO 27001 certified?Does Notion AI train on your data?

See the full Notion AI risk profile, with every data-handling fact and its source, or browse all rated AI tools.