GDPR checklist for project management tools.
Project tools store tasks, comments and attachments that name colleagues, customers and candidates. Compare 6 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 Linear | Usually a processor | Usually the United States | Published by the vendor |
 Atlassian | Usually a processor | Set per account or project | Published by the vendor |
 Asana | Usually a processor | Set per account or project | Published by the vendor |
 monday.com | Usually a processor | Set per account or project | Published by the vendor |
 ClickUp | Usually a processor | Set per account or project | Published by the vendor |
 Basecamp | Usually a processor | Set per account or project | Published by the vendor |
What to check for project management tools
- Decide what customer data may go into tasks and comments.
- Check retention for archived projects and attachments.
- Review guest access and integrations.
- Record the data region if the plan offers a choice.
Questions, answered.
What should I check before using a project management tool under the GDPR?
Decide what customer data may go into tasks and comments. Check retention for archived projects and attachments. Review guest access and integrations. Record the data region if the plan offers a choice.
Do I need a data processing agreement with a project management provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which project management tools does Privacyboard cover?
Linear, Atlassian, Asana, monday.com, ClickUp, Basecamp. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.