GDPR checklist for collaboration tools.
Collaboration tools hold whatever your team writes or shares, including personal data in documents and messages. Compare 6 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 Google Workspace | Usually a processor | Set per account or project | Published by the vendor |
 Slack | Usually a processor | Often the United States, check your account | Published by the vendor |
 Notion | Usually a processor | Often the United States, check your account | Obtained through the vendor |
 Airtable | Usually a processor | Often the United States, check your account | Published by the vendor |
 Microsoft 365 | Usually a processor | Set per account or project | Obtained through the vendor |
 Miro | Usually a processor | Set per account or project | Published by the vendor |
What to check for collaboration tools
- Decide which kinds of personal data may be pasted into the tool, and tell the team.
- Check the retention and deletion settings for messages and files.
- Review who has admin access and how guests are handled.
- Record the data region if the plan offers a choice.
Questions, answered.
What should I check before using a collaboration tool under the GDPR?
Decide which kinds of personal data may be pasted into the tool, and tell the team. Check the retention and deletion settings for messages and files. Review who has admin access and how guests are handled. Record the data region if the plan offers a choice.
Do I need a data processing agreement with a collaboration provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which collaboration tools does Privacyboard cover?
Google Workspace, Slack, Notion, Airtable, Microsoft 365, Miro. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.