TL;DR
Notion is a one-of-a-kind tool that serves multiple purposes. It may or may not be GDPR-compliant, as it depends on how it’s used.
- How to maintain GDPR compliance with Notion
- Do I need a cookie banner with Notion?
- What Notion’s Privacy Policy/GDPR page says
- About Notion
- Who are we
How to maintain GDPR compliance with Notion
Notion is a note-taking and database tool that can be used in various ways, and its ability can be increased using the native integrations that it provides.
These diverse capabilities make it complex to ensure GDPR compliance with Notion. Here are some must-follow steps to ensure GDPR compliance with Notion.
Determine what user data is sent to Notion
Every team uses Notion differently, and it’s important to understand what data is sent to Notion to make it compliant with GDPR.
If no user's PII (Personally Identifiable Information) is sent to Notion, then GDPR compliance is automatically met. However, if any is sent, you need to note it and ensure it’s in accordance with GDPR and your organization’s privacy policy.
Add Notion to list of data processors
Next, ensure that Notion is included in the data sub-processor section of your privacy policy page. This is mandatory under the new GDPR regulations, and all businesses must comply.
Here’s how you need to mention Notion in your privacy policy page
When data from Notion is transferred to another tool, those tools must also be added to the list of data sub-processors.
Monitor data security
According to Article 33 of the GDPR law, it is mandatory to notify users in the event of a data breach. To comply with this, it is essential to monitor Notion to ensure no data breaches are reported by them. While such incidents are unlikely, they remain a possibility.
Additionally, it’s recommended that you ensure security by having a strong password with Multi-Factor Authentication (MFA) enabled. Even though it's not mandatory, doing this will help you with any possible data leaks due to account hacking, which may cause legal trouble.
Do I need a cookie banner with Notion?
No.
Notion doesn’t store any cookies on your website. Hence, no cookie banner is needed when using it in your organization.
What Notion’s Privacy Policy/GDPR page says
Source: https://www.notion.com/help/gdpr-at-notion
Notion is devoted to ensuring customer success and safeguarding personal data by adhering to the General Data Protection Regulation (GDPR) and similar privacy laws. This regulation governs the use of personal data of EU residents, granting individuals control over their data and imposing obligations on data-processing organizations.
Key Aspects
- Data Processing Addendum: The Notion Data Processing Addendum (DPA) sets the terms for Notion's handling of personal data under the GDPR, ensuring compliance when processing customer data.
- Data Portability & Management Tools:
- Import: Notion offers import options from various formats such as text, markdown files, CSV, Microsoft Word, HTML, and more.
- Export: Users can export entire workspaces or individual pages in markdown format.
- Workspace Deletion: Workspaces can be deleted anytime, leading to immediate content inaccessibility and full server deletion after 30 days.
- Workspace Settings: Tools are available for managing settings like name, members, and email domains.
- Data Transfers: Standard contractual clauses (SCCs) are used to ensure safeguards for data transfers from the EU to other regions, guided by the Schrems II ruling.
- Subprocessors: Notion collaborates with vetted companies for service provision, ensuring they meet top security standards. More details are available in their List of Subprocessors.
This content can be modified or updated by Notion at any time and serves an informational purpose.
About Notion
Notion is a versatile productivity tool designed to help individuals and teams organize their work and personal lives in one integrated platform. It combines notes, tasks, databases, and collaboration features, enabling users to customize how they manage projects and information.
Notion's flexibility allows users to create to-do lists, plan projects, write documents, and set up databases without switching between multiple apps. With real-time collaboration capabilities, it's ideal for team use, fostering seamless communication and coordination. Notion's user-friendly interface and extensive customization options make it a popular choice for both personal productivity and professional project management.
Who are we
We are Simple Analytics, a privacy-friendly and GDPR-compliant Google Analytics alternative. We're EU-based & hosted, and normally best friend with your legal team (ask Michelin, Bloomberg, Mollie). Our aim is to improve data privacy by providing the website you need while being 100% compliant out of the box.
Freel free to give us a try. If you want me to show a demo, please schedule something using my link.