--- title: "Airtable and GDPR: DPA, Data Residency, and Compliance for German Companies" description: "Airtable is GDPR-compliant on Enterprise plans with a signed DPA. Here is what German businesses must check before using Airtable for personal data." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/airtable/" language: "en" --- ![Airtable GDPR compliance guide for German companies](https://compound.law/assets/images/tools/tools_2.webp) tools # Airtable and GDPR: DPA, Data Residency, and Compliance for German Companies 11 April 2026 Short answer Airtable is GDPR-compliant on Enterprise plans with a signed DPA, SCCs, and correct sub-processor setup. Business, Pro, and Free plans have no DPA and are unsuitable for professional personal data use. German companies must also check works council obligations if Airtable tracks employee tasks or performance. - DPA is only available on Enterprise plans — lower tiers are not suitable for personal data. - Data is processed in the US; SCCs and EU-US DPF participation provide the transfer basis. - Works council involvement may be required for task tracking, HR, or performance use cases. **Airtable is GDPR-compliant on Enterprise plans with a signed Data Processing Agreement — but only on Enterprise plans.** For Business, Pro, and Free subscribers, no DPA exists, making Airtable unsuitable for professional work involving personal data under GDPR. German companies that use Airtable as a spreadsheet, relational database, or operational data platform need to verify the DPA, US data transfer setup, sub-processor obligations, and works council requirements before processing personal data in Airtable. For a broader overview of tools assessed for GDPR compliance, see the [AI and software tools reviewed by Compound Law](https://compound.law/en-DE/tools/). For teams evaluating Airtable AI features specifically — including field-level AI actions and AI-generated record processing — the [Airtable AI and GDPR guide](https://compound.law/en-DE/tools/airtable-ai/) covers those data flows in depth. This page focuses on the **core Airtable product**: bases, records, and standard automations, without AI features. ## Is Airtable GDPR Compliant? Yes, with conditions. Airtable can be operated in a GDPR-compliant manner if the following requirements are met: 1. The company is on an **Airtable Enterprise plan** with a signed Data Processing Agreement. 2. **Standard Contractual Clauses (SCCs)** are in place for data transfers from the EU to Airtable’s US-based infrastructure. 3. The company has updated its **Records of Processing Activities** under GDPR Article 30. 4. Sub-processor arrangements and change notifications have been reviewed and documented. Without the Enterprise DPA, Airtable is not suitable for processing personal data in a professional context under GDPR. Airtable Business, Pro, and Free plans do not include DPA coverage, and that gap cannot be bridged by internal policies or supplementary agreements. For German and DACH companies, the GDPR analysis centers on four practical questions: - **Is a DPA signed?** Only possible on Enterprise plans. - **Where is data processed?** Primarily in the United States, with no standard EU residency option. - **Which transfer mechanism applies?** Standard Contractual Clauses and EU-US Data Privacy Framework (DPF) participation. - **Are there employee-data implications?** Potentially — if Airtable is used to track tasks, attendance, or project performance. ## Does Airtable Have a Data Processing Agreement (DPA)? Yes. Airtable provides a Data Processing Agreement for Enterprise customers. A DPA is required under GDPR Article 28 whenever a vendor processes personal data on behalf of a company, acting as a data processor. Without it, the processing lacks a valid contractual basis. The Airtable Enterprise DPA covers: - Processing instructions and purpose limitations - Sub-processor disclosure and notification obligations - Standard Contractual Clauses for EU-to-US data transfers - Security and confidentiality commitments - Data return and deletion on contract termination **The DPA is a necessary starting point, not a complete compliance answer.** Beyond signing the DPA, German companies need to: - Update their Article 30 Records of Processing Activities to include Airtable and its sub-processors - Subscribe to sub-processor change notifications and review additions - Assess whether a **Data Protection Impact Assessment (DPIA)** is required under Article 35 GDPR based on the data type and processing scale - Confirm that the SCCs in the DPA cover all actual data flows, including any third-party integrations For comparison, see how [Monday.com approaches GDPR compliance](https://compound.law/en-DE/tools/monday-ai/) — another operations and project platform with Enterprise DPA coverage — and [Notion’s GDPR setup](https://compound.law/en-DE/tools/notion-ai/) for database-style workspace tools. ## Airtable Data Residency and US Data Transfers Airtable’s infrastructure is primarily based in the United States. Standard plans do not offer EU or EEA data residency. Enterprise customers may be able to negotiate specific data handling arrangements — verify this directly with Airtable’s sales team during procurement. For the transfer of personal data from the EU to Airtable’s US infrastructure, two transfer mechanisms apply: | Transfer mechanism | What it covers | Airtable status | | ----------------------------------- | -------------------------------------------------------------------------------- | -------------------------- | | Standard Contractual Clauses (SCCs) | EU-approved contractual clauses for third-country transfers under Chapter V GDPR | Included in Enterprise DPA | | EU-US Data Privacy Framework (DPF) | Adequacy-based transfer framework for certified US processors | Airtable participates | For most German companies, SCCs and DPF participation together provide an adequate transfer basis under current GDPR guidance. A few additional considerations apply: - The DPF is a political and legal instrument that can be challenged or revised — SCCs remain the more durable contractual backup mechanism - Companies in regulated sectors (financial services, healthcare, public sector) may face sector-specific restrictions on US-based data processing that go beyond standard GDPR requirements - If your organization requires EU-only data residency due to internal policy, customer contracts, or regulatory obligations, clarify with Airtable whether Enterprise arrangements can satisfy this requirement before committing to a deployment ## What German Companies Need to Do Before Using Airtable A practical pre-deployment checklist for GDPR compliance: 1. **Confirm Enterprise plan status** — Airtable’s DPA is not available on lower-tier plans. Do not process personal data on Business, Pro, or Free plans. 2. **Sign and review the DPA** — verify the contracting entity, sub-processor coverage, transfer mechanism, and deletion terms match your intended use. 3. **Update your Article 30 Records of Processing Activities** — add Airtable as a vendor and specify the categories of personal data, the processing purpose, the transfer mechanism, and the retention period. 4. **Review Airtable’s sub-processor list** — identify which infrastructure and service providers are involved, and configure change notifications for new additions. 5. **Assess the need for a DPIA** — a Data Protection Impact Assessment under GDPR Article 35 is required if Airtable will process special category data, large volumes of employee data, or enable systematic monitoring. 6. **Review customer contracts** — some commercial agreements restrict cross-border processing or subcontracting of client data. Check whether using Airtable is consistent with your customer-facing contractual obligations. 7. **Define permitted and restricted use cases** — specify which bases and record types may contain personal data and which should remain restricted. 8. **Assess works council obligations** — see the section below. ## Airtable and the Works Council (Betriebsrat) In Germany, the works council (**Betriebsrat**) has co-determination rights under Section 87(1) No. 6 of the Works Constitution Act (Betriebsverfassungsgesetz, **BetrVG**) when a new technical system is introduced that is capable of monitoring employee behavior or performance — even if monitoring is not the primary purpose of the deployment. Airtable is frequently used for purposes that can trigger this obligation: - **Employee task management** — recording which employee completed which task, with timestamps and status fields - **Project tracking and time logging** — linking work output and completion rates to individual team members - **HR operations and onboarding workflows** — storing onboarding checklists, role progressions, or absence records - **Performance reporting** — views and dashboards that aggregate individual employee-level data The key legal question under BetrVG is not whether monitoring is intended, but whether the system is **technically capable** of creating visibility into individual employee behavior or output. Airtable’s flexible base and view structure means that many operational deployments can satisfy that technical threshold. German companies should assess works council obligations early in the procurement process — ideally before finalizing the vendor selection. A **Betriebsvereinbarung** (works agreement) specifying permitted use cases, access restrictions, retention periods, and prohibited applications is often the appropriate outcome of that process. For detailed guidance on how digital workplace tools interact with German labor law and co-determination rights, see the [AI employee monitoring compliance framework](https://compound.law/en-DE/compliance/ai-employee-monitoring/). ## Our Assessment Airtable Enterprise is deployable under GDPR with the right contractual and technical setup. The DPA exists, Standard Contractual Clauses are included, and sub-processors are documented. The compliance steps are consistent with other US-based SaaS platforms: sign the DPA, confirm the transfer mechanism, update your Article 30 records, and engage the works council if Airtable will handle employee task or performance data. **Airtable Business and lower-tier plans are not suitable for any professional use involving personal data.** The missing DPA cannot be substituted by contract workarounds or internal data handling rules. For teams that also use or are considering Airtable AI features — including AI field actions, automated classification, and AI-generated content — the [Airtable AI GDPR guide](https://compound.law/en-DE/tools/airtable-ai/) covers those specific data flows and sub-processor implications separately. Compound Law supports German and DACH companies with Airtable DPA review, SCC and transfer assessments, Article 30 documentation, DPIA preparation, and works council strategy for Airtable rollouts involving employee or operational data. Specific situations require individual legal advice — this guide structures the review but does not replace a fact-specific assessment of your data flows, contracts, and organizational setup. ## FAQ ### Is Airtable GDPR compliant? Yes, on Enterprise plans with a signed Data Processing Agreement. Airtable Business, Pro, and Free plans do not include DPA coverage and are not suitable for professional use involving personal data under GDPR. ### Does Airtable have a Data Processing Agreement (DPA)? Yes. Airtable offers a DPA for Enterprise customers, covering sub-processors, Standard Contractual Clauses for EU-to-US transfers, and deletion and return terms. Lower-tier plans do not include a DPA. ### Where does Airtable store data? Airtable processes and stores data on infrastructure based in the United States. There is no standard EU data residency option on current plans. Enterprise customers may be able to negotiate specific data handling arrangements. Standard Contractual Clauses and EU-US Data Privacy Framework participation provide the legal basis for the EU-to-US transfer. ### Do German companies need to involve the works council before using Airtable? Possibly. If Airtable will be used to track employee tasks, project work, attendance, or performance, works council co-determination rights under Section 87(1) No. 6 BetrVG may apply. This assessment should happen before deployment, not after the system goes live. ### Is a DPIA required for Airtable? A Data Protection Impact Assessment is required if Airtable will process special category data under GDPR Article 9 or enable systematic employee monitoring. For standard operational databases without sensitive data categories, a DPIA is typically not required — but documenting the assessment decision is recommended regardless. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Yes, on Enterprise plans with a signed DPA. Business, Pro, and Free plans have no DPA and are not suitable for professional use involving personal data under GDPR. Yes. Airtable provides a DPA for Enterprise customers, covering subprocessors, Standard Contractual Clauses, and deletion terms. Lower-tier plans do not include a DPA. Airtable processes and stores data on US-based infrastructure. There is no standard EU data residency option. Enterprise customers may negotiate specific arrangements. SCCs and DPF participation cover the legal basis for EU-to-US transfers. Possibly. If Airtable tracks employee tasks, project work, or performance, works council co-determination rights under Section 87(1) No. 6 BetrVG may apply. The assessment should happen before rollout. A DPIA is required if Airtable processes special category data or is used for systematic employee monitoring. For standard operational databases without sensitive data, a DPIA is typically not required, but documenting the assessment is recommended. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Airtable and GDPR: DPA, Data Residency, and Compliance for German Companies", "description": "Airtable is GDPR-compliant on Enterprise plans with a signed DPA. Here is what German businesses must check before using Airtable for personal data.", "image": "https://compound.law/assets/images/tools/tools_2.webp", "datePublished": "2026-04-11T00:00:00.000Z", "dateModified": "2026-04-11T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/airtable/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Airtable and GDPR: DPA, Data Residency, and Compliance for German Companies", "item": "https://compound.law/en-DE/tools/airtable/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is Airtable GDPR compliant?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, on Enterprise plans with a signed DPA. Business, Pro, and Free plans have no DPA and are not suitable for professional use involving personal data under GDPR." } }, { "@type": "Question", "name": "Does Airtable have a Data Processing Agreement (DPA)?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Airtable provides a DPA for Enterprise customers, covering subprocessors, Standard Contractual Clauses, and deletion terms. Lower-tier plans do not include a DPA." } }, { "@type": "Question", "name": "Where does Airtable store data?", "acceptedAnswer": { "@type": "Answer", "text": "Airtable processes and stores data on US-based infrastructure. There is no standard EU data residency option. Enterprise customers may negotiate specific arrangements. SCCs and DPF participation cover the legal basis for EU-to-US transfers." } }, { "@type": "Question", "name": "Do German companies need to involve the works council before using Airtable?", "acceptedAnswer": { "@type": "Answer", "text": "Possibly. If Airtable tracks employee tasks, project work, or performance, works council co-determination rights under Section 87(1) No. 6 BetrVG may apply. The assessment should happen before rollout." } }, { "@type": "Question", "name": "Is a DPIA required for Airtable?", "acceptedAnswer": { "@type": "Answer", "text": "A DPIA is required if Airtable processes special category data or is used for systematic employee monitoring. For standard operational databases without sensitive data, a DPIA is typically not required, but documenting the assessment is recommended." } } ] } ] ```