GDPR checklist for search tools.
Search services index your content and receive visitors’ queries, which can reveal personal details. Compare 3 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 Algolia | Usually a processor | Set per account or project | Published by the vendor |
 Typesense Cloud | Usually a processor | Set per account or project | Published by the vendor |
 Luigi's Box | Usually a processor | Set per account or project | Published by the vendor |
What to check for search tools
- Index only the fields you need to search.
- Decide whether queries are logged, and for how long.
- Check the region of each index or cluster.
- Remove a person’s records from the index when you delete them elsewhere.
All search tools
Questions, answered.
What should I check before using a search tool under the GDPR?
Index only the fields you need to search. Decide whether queries are logged, and for how long. Check the region of each index or cluster. Remove a person’s records from the index when you delete them elsewhere.
Do I need a data processing agreement with a search provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which search tools does Privacyboard cover?
Algolia, Typesense Cloud, Luigi's Box. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.