GDPR checklist for automation tools.
Automation tools pass records between your other tools, so they process whatever flows through each workflow. Compare 2 common tools and see what to check for each.
Zapier
MakeWhat to check for automation tools
- List the workflows that carry personal data and what fields they pass.
- Check run-history retention, since inputs and outputs are often logged.
- Review which connected apps the tool can read.
- Record the provider as a recipient and note its region.
All automation tools
Questions, answered.
What should I check before using an automation tool under the GDPR?
List the workflows that carry personal data and what fields they pass. Check run-history retention, since inputs and outputs are often logged. Review which connected apps the tool can read. Record the provider as a recipient and note its region.
Do I need a data processing agreement with an automation provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which automation tools does Privacyboard cover?
Zapier, Make. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.