GDPR checklist for development tools.
Development platforms hold source code and issue history that can contain personal data by accident. Compare 4 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 GitHub | Usually a processor | Often the United States, check your account | Published by the vendor |
 GitLab | Usually a processor | Often the United States, check your account | Published by the vendor |
 LaunchDarkly | Usually a processor | Often the United States, check your account | Published by the vendor |
 Liveblocks | Usually a processor | Set per account or project | Published by the vendor |
What to check for development tools
- Keep secrets and customer data out of repositories and issues.
- Review who has access and how departures are handled.
- Check the retention of issues, logs and deleted repositories.
- Record the provider where personal data is processed through it.
All development tools
Questions, answered.
What should I check before using a development tool under the GDPR?
Keep secrets and customer data out of repositories and issues. Review who has access and how departures are handled. Check the retention of issues, logs and deleted repositories. Record the provider where personal data is processed through it.
Do I need a data processing agreement with a development provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which development tools does Privacyboard cover?
GitHub, GitLab, LaunchDarkly, Liveblocks. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.