--- title: "Asana GDPR Compliance: DPA, Data Residency, and What EU Teams Need to Know" description: "Asana's EU data residency: customer data is stored in the EU on Enterprise and Enterprise+ plans only. DPA/SCCs explained for German teams." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/asana-ai/" language: "en" --- ![Asana GDPR compliance and data processing agreement for German companies](https://compound.law/assets/images/tools/tools_4.webp) tools # Asana GDPR Compliance: DPA, Data Residency, and What EU Teams Need to Know 5 April 2026 **Yes, Asana does offer a Data Processing Agreement (DPA) and EU data residency options — but full data residency is only available on Asana Enterprise plans.** German and DACH companies evaluating Asana under GDPR need to verify more than DPA availability: Asana Intelligence AI features, sub-processor chains, and works council obligations all require assessment before deployment. For a broader view of workplace and project management AI tools, see the [AI tools assessed by Compound Law](https://compound.law/en-DE/tools/). ## What is Asana AI? Asana is a cloud-based project management and work coordination platform headquartered in the United States. It is widely used by operations, marketing, HR, and product teams to manage projects, tasks, and workflows. In 2024, Asana introduced **Asana Intelligence** — its built-in AI layer — which provides features including AI-powered task summaries, smart status updates, goal progress analysis, and workflow suggestions. Because Asana processes work data, project communications, and employee task records on behalf of its business customers, it functions as a data processor under GDPR Article 28. A valid Data Processing Agreement is required before processing personal data through the platform in a professional context in Germany or the EU. ## Is Asana GDPR-Compliant? Asana can be used in a GDPR-compliant manner with the correct plan and contractual setup. All paid Asana plans (Premium, Business, Enterprise, and Enterprise+) include DPA coverage. The DPA is incorporated by reference into Asana’s standard subscription terms for EU customers. Key points for German companies: - **DPA availability:** Asana provides a DPA for all paid plan customers. Free plan users are not covered by a standard DPA. - **AI training data:** Asana states that it does not use customer data to train its AI models. Asana Intelligence features are built on third-party large language models — review the current sub-processor list to identify which AI model providers are used. - **Data residency:** EU data residency is available on Asana Enterprise and Enterprise+ plans. Standard and Business plan data is processed on Asana’s US-based infrastructure, with SCCs covering the transfer. - **Sub-processors:** Asana maintains a published sub-processor list. This includes infrastructure providers and the third-party LLM APIs powering Asana Intelligence. - **Standard Contractual Clauses:** Asana includes EU Standard Contractual Clauses in its DPA for data transfers from the EU/EEA to the United States. - **EU-US Data Privacy Framework:** Asana participates in the EU-US Data Privacy Framework (DPF), providing an additional basis for EU-to-US personal data transfers. ## Asana DPA and Standard Contractual Clauses Asana’s Data Processing Agreement covers Asana’s processing of personal data on behalf of customers, including data processed through Asana Intelligence features. For German companies, executing the DPA is necessary but not sufficient on its own. Before deploying Asana in a context involving personal data, you should also: 1. Confirm that Standard Contractual Clauses are in place for EU-to-US data transfers to Asana and its sub-processors — these are incorporated into Asana’s DPA by default for EU customers. 2. Update your **Records of Processing Activities** (Verzeichnis von Verarbeitungstätigkeiten, Article 30 GDPR) to include Asana and its sub-processors. 3. Conduct a **Data Protection Impact Assessment (DPIA)** if Asana will be used to process HR data at scale, special category data (Article 9 GDPR), or data relating to a large number of individuals. 4. Subscribe to Asana’s sub-processor change notifications — the DPA grants notification rights when Asana adds or changes sub-processors. For comparison, see how [Monday.com handles GDPR](https://compound.law/en-DE/tools/monday-ai/) — a direct competitor with similar enterprise DPA and residency arrangements — and [Notion’s GDPR setup](https://compound.law/en-DE/tools/notion-ai/) for workspace and documentation tools. If your team also uses Slack for project communication, see [Slack GDPR compliance](https://compound.law/en-DE/tools/slack-ai/). ## Asana AI Features Under GDPR Asana Intelligence introduces additional data protection considerations beyond standard project management data: **AI-powered task summaries and status updates** process the content of project tasks, comments, and attachments — which may include employee names, customer references, and business-sensitive information. Review whether this content constitutes personal data and ensure your DPA covers this processing. **Goal progress analysis and portfolio insights** use aggregated project data to generate recommendations. If this data relates to identifiable employees’ work output, assess the implications for employee data protection under German law (§26 BDSG in conjunction with GDPR). Relevant compliance frameworks include [AI employee monitoring compliance](https://compound.law/en-DE/compliance/ai-employee-monitoring/) and [AI scheduling optimization compliance](https://compound.law/en-DE/compliance/ai-scheduling-optimization/), which apply wherever Asana Intelligence influences how work is assigned or tracked. **Workflow automation with AI triggers** may process personal data without direct human review at each step. Assess whether any automated processing qualifies as automated decision-making under GDPR Article 22, particularly if the outputs affect employees or external stakeholders. **Third-party LLM integration:** Asana Intelligence is powered by external large language models. The prompts and context passed to these models may include personal data. Review Asana’s current sub-processor list and the data processing terms for each AI provider involved. For broader guidance on AI tools in the workplace, see our [AI writing assistants and GDPR compliance guide](https://compound.law/en-DE/compliance/ai-writing-assistants/). ## Data Residency and Sub-Processors **Asana stores EU customer data at rest in the EU for customers on Enterprise and Enterprise+ plans — the only tiers that include EU data residency.** This is a meaningful differentiator for German companies in regulated sectors or those with strict data localisation requirements. For Business and lower plans, data is processed on Asana’s US-based infrastructure. The DPA includes Standard Contractual Clauses to cover this transfer, but the data does not remain in the EU at rest. Asana’s sub-processor list includes: - **Infrastructure:** Amazon Web Services (AWS) for hosting and data storage - **AI model providers:** Third-party LLM APIs powering Asana Intelligence (check the current list, as these can change with feature updates) - **Support tooling:** Ticketing and communication tools used by Asana’s support and operations teams When Asana adds new sub-processors, Enterprise DPA customers receive advance notice — verify that your data protection team receives and reviews these notifications. ## Our Assessment For German project and operations teams, Asana is one of the better-positioned project management tools for GDPR compliance. A DPA is available on all paid plans, EU data residency is available on Enterprise, SCCs are built into the DPA, and AI training data exclusions apply. The compliance steps are: confirm the DPA is active, verify SCCs, assess Asana Intelligence data flows, and consult your Betriebsrat if the tool processes employee activity data at scale. Asana AI is commonly adopted by [professional services companies](https://compound.law/en-DE/ai-act/professional-services/) and organisations with [HR and recruitment AI compliance](https://compound.law/en-DE/ai-act/recruitment-hr/) obligations, where project transparency and employee data governance are both critical. For teams that need EU data residency, Asana Enterprise or Enterprise+ is the right tier. For smaller teams on Business plans, the SCCs provide a legal transfer mechanism but data will be processed in the US. Compound Law can assist with DPA review, DPIA preparation, SCC implementation, and works council negotiations for Asana deployments. *** ## Frequently Asked Questions ### Does Asana have a DPA (Data Processing Agreement)? Yes. Asana provides a Data Processing Agreement for all paid plan customers. The DPA is incorporated into Asana’s EU subscription terms by default. Free plan users are not covered by a standard DPA and should not use Asana for professional data processing under GDPR. ### Is Asana GDPR compliant for German companies? Asana can be used in a GDPR-compliant manner on paid plans, with a signed DPA, Standard Contractual Clauses for US data transfers, and updated records of processing activities. EU data residency is available on Enterprise and Enterprise+ plans. A DPIA should be conducted where Asana is used for large-scale HR data or sensitive processing activities. ### Does Asana use customer data to train AI? Asana states that it does not use customer data to train its AI models. Asana Intelligence features are powered by third-party LLM APIs — review the current sub-processor list to identify which AI providers are involved and check their data processing terms. ### Is Asana DSGVO-konform? Asana kann auf kostenpflichtigen Plänen DSGVO-konform eingesetzt werden. Ein AVV ist für alle bezahlten Pläne verfügbar. EU-Datenspeicherung ist nur auf Enterprise- und Enterprise+-Plänen verfügbar. Für deutsche Unternehmen sind AVV, Standardvertragsklauseln, ein aktuelles Verarbeitungsverzeichnis und ggf. eine DSFA erforderlich. ### Does Asana offer EU data residency? Yes, Asana offers EU data residency on Enterprise and Enterprise+ plans. On these plans, customer data at rest is stored within the EU. Business and lower-tier plans process data on US-based infrastructure, with Standard Contractual Clauses providing the legal basis for the EU-to-US transfer. ### Does Asana have to be approved by the Betriebsrat? If Asana is used across a team and captures employee activity data — such as task completion rates, time-tracking, or workload metrics — the works council (Betriebsrat) may have co-determination rights under §87 BetrVG. Early engagement with the Betriebsrat is recommended before any company-wide rollout. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Asana stores customer data on Amazon Web Services infrastructure. On Enterprise and Enterprise+ plans, EU customer data at rest is stored in the EU. Business and lower-tier plans process data on Asana's US-based infrastructure, with Standard Contractual Clauses covering the EU-to-US transfer. Check Asana's published sub-processor list for the current infrastructure and AI providers involved. Yes, Asana offers EU data residency on Enterprise and Enterprise+ plans. On these plans, customer data at rest is stored within the EU. Business and lower-tier plans process data on US-based infrastructure, with Standard Contractual Clauses providing the legal basis for the EU-to-US transfer. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Asana GDPR Compliance: DPA, Data Residency, and What EU Teams Need to Know", "description": "Asana's EU data residency: customer data is stored in the EU on Enterprise and Enterprise+ plans only. DPA/SCCs explained for German teams.", "image": "https://compound.law/assets/images/tools/tools_4.webp", "datePublished": "2026-04-05T00:00:00.000Z", "dateModified": "2026-04-05T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/asana-ai/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Asana GDPR Compliance: DPA, Data Residency, and What EU Teams Need to Know", "item": "https://compound.law/en-DE/tools/asana-ai/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Where is Asana data stored?", "acceptedAnswer": { "@type": "Answer", "text": "Asana stores customer data on Amazon Web Services infrastructure. On Enterprise and Enterprise+ plans, EU customer data at rest is stored in the EU. Business and lower-tier plans process data on Asana's US-based infrastructure, with Standard Contractual Clauses covering the EU-to-US transfer. Check Asana's published sub-processor list for the current infrastructure and AI providers involved." } }, { "@type": "Question", "name": "Does Asana offer EU data residency?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, Asana offers EU data residency on Enterprise and Enterprise+ plans. On these plans, customer data at rest is stored within the EU. Business and lower-tier plans process data on US-based infrastructure, with Standard Contractual Clauses providing the legal basis for the EU-to-US transfer." } } ] } ] ```