GDPR checklist for cms tools.
Content platforms store what you publish, plus editor accounts, and sometimes data collected through forms or integrations. Compare 2 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 Contentful | Usually a processor | Set per account or project | Published by the vendor |
 Sanity | Usually a processor | Set per account or project | Published by the vendor |
What to check for cms tools
- Keep personal data out of content entries unless you need it.
- Check the region chosen for each project or space.
- Review editor accounts and remove people who have left.
- Record any integration that sends content or visitor data elsewhere.
All cms tools
Questions, answered.
What should I check before using a cms tool under the GDPR?
Keep personal data out of content entries unless you need it. Check the region chosen for each project or space. Review editor accounts and remove people who have left. Record any integration that sends content or visitor data elsewhere.
Do I need a data processing agreement with a cms provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which cms tools does Privacyboard cover?
Contentful, Sanity. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.