GDPR checklist for design tools.
Design tools hold files and comments that sometimes include real customer data copied into mockups. Compare 2 common tools and see what to check for each.
Figma
CanvaWhat to check for design tools
- Use sample data in mockups rather than real customer data.
- Review sharing links and guest access.
- Check retention of deleted files and version history.
- Record the data region if the plan offers a choice.
All design tools
Questions, answered.
What should I check before using a design tool under the GDPR?
Use sample data in mockups rather than real customer data. Review sharing links and guest access. Check retention of deleted files and version history. Record the data region if the plan offers a choice.
Do I need a data processing agreement with a design provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which design tools does Privacyboard cover?
Figma, Canva. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.