--- title: "Asana DPA: GDPR Data Processing Agreement for German Companies" description: "Asana includes a DPA on all paid plans. German companies must verify EU data residency, subprocessors, and BetrVG before processing personal data in Asana." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/asana-dpa/" language: "en" --- ![Asana DPA and GDPR compliance guide for German companies](https://compound.law/assets/images/tools/tools_4.webp) tools # Asana DPA: GDPR Data Processing Agreement for German Companies 26 April 2026 Short answer Asana automatically includes a Data Processing Agreement on all paid plans (Premium, Business, Enterprise, Enterprise+). German companies do not need to request it separately — but must verify EU data residency and review subprocessors for their use case. - DPA is auto-included on Premium, Business, Enterprise, and Enterprise+ plans — free plan excluded. - EU data residency is available on Enterprise and Enterprise+ plans only. - Subprocessor list is public; German companies have a contractual right to object to additions. - BetrVG may apply if Asana is used to track task completion or assess employee performance. **Asana includes a Data Processing Agreement (DPA) automatically on all paid plans. German companies do not need to separately request it — but they must be on a paid plan and should verify EU data residency requirements for their specific use case.** The free plan is excluded from DPA coverage. EU data residency is only available on Enterprise and Enterprise+ plans. This page explains what the Asana DPA covers, how EU data residency works, what to know about subprocessors, and what BetrVG implications apply for German businesses. For a broader GDPR overview of Asana, see our [main Asana GDPR guide](https://compound.law/en-DE/tools/asana/). This page provides general information and is not legal advice for a specific situation. ## Does Asana Have a Data Processing Agreement? Yes. Asana provides a DPA for all paid plan customers (Premium, Business, Enterprise, and Enterprise+). For EU customers, the DPA is automatically incorporated into Asana’s subscription terms — no separate request or negotiation is required. **GDPR Article 28** requires a DPA whenever a company engages a third party to process personal data on its behalf. Asana acts as a data processor when it stores and processes tasks, projects, comments, or attachments that contain personal data — such as names, email addresses, or information about employees or customers. The Asana DPA obliges Asana to: - Process personal data only on documented instructions from the customer - Maintain confidentiality and restrict access to authorised personnel - Assist with data subject rights requests (access, deletion, correction) - Notify customers of security incidents without undue delay - Delete or return personal data at the end of the contract **Free plan users:** Asana does not offer a DPA on the free plan. Companies must not use the free plan to process personal data of employees or customers in a GDPR-relevant context. ## What Does the Asana DPA Cover? The Asana DPA addresses the mandatory content under GDPR Article 28 across the following areas: **Data categories and subject matter:** The DPA defines the processing scope in terms of the data types a customer stores in Asana — project data, task data, and any personal data uploaded in comments or attachments. Customers are responsible for ensuring that what they actually use Asana for matches the stated scope. **Standard Contractual Clauses (SCCs):** For EU customers on plans without EU data residency (Premium, Business), data is processed on US-based infrastructure. Asana incorporates Standard Contractual Clauses into its DPA to cover this EU-to-US transfer, as required under GDPR Chapter V. Asana also participates in the EU-US Data Privacy Framework (DPF). **Subprocessors:** Asana uses a list of approved subprocessors to operate its service. This list is publicly available and updated with at least 30 days’ advance notice of changes. Customers have a contractual right to object to new subprocessor additions — a right that German privacy teams should monitor actively. **Processor obligations and audit rights:** The DPA includes provisions for data security (Article 32 GDPR), data breach notification, and customer audit rights. ## Asana Data Residency Europe EU data residency is available on **Enterprise** and **Enterprise+** plans. With this option enabled, Asana stores customer data at rest in EU-based data centres. This addresses the strictest data localisation requirements that some German companies and public-sector organisations face. **Lower-tier plans (Business, Premium, Free):** Data is stored on US-based infrastructure. The EU-to-US transfer is covered by Standard Contractual Clauses and DPF participation — sufficient for most German companies under current GDPR guidance, but not equivalent to EU data residency. **What EU data residency does not cover:** Even on Enterprise plans with EU data residency enabled, some data — such as account metadata or data processed by specific Asana subprocessors — may still be processed outside the EU. Customers with strict requirements should review Asana’s data residency documentation and verify the scope with their Asana enterprise contact. ## Asana Subprocessors — What to Know Asana maintains a public subprocessor list on its privacy documentation page. Key points for German compliance teams: - The list includes infrastructure providers (such as AWS) and functional subprocessors for monitoring and support - Asana provides at least **30 days’ advance notice** before adding new subprocessors, via email or a publicly updated changelog - Customers have a contractual right to object to new subprocessors within the notification window - A sustained objection may give the customer a right to terminate the contract without penalty For German companies operating under sectoral requirements (healthcare, financial services, public sector), reviewing the subprocessor list for high-risk processing flows is an important compliance step. ## Asana and the Works Council (BetrVG) in Germany German companies using Asana for internal task management and project coordination must assess whether the use triggers **co-determination rights** under Section 87(1) No. 6 of the Works Constitution Act (Betriebsverfassungsgesetz, BetrVG). This provision requires works council involvement when a technical system is capable of monitoring employee behaviour or performance. Asana can trigger BetrVG obligations when used to: - Assign tasks to named employees and track completion - Monitor response times or task completion rates - Generate reports on individual employee workload or productivity - Track deadlines and overdue tasks per employee If these features are used and a works council exists, a **Betriebsvereinbarung** (works council agreement) is required before rollout. This agreement typically defines which data is collected, how long it is retained, and who has access to performance-related reports. For HR-specific use cases — onboarding workflows, absence tracking, or performance management — the BetrVG assessment is particularly important and may also require a **Data Protection Impact Assessment (DPIA)** under GDPR Article 35. ## Asana DPA Checklist for German Companies Before processing personal data in Asana, German companies should verify: 1. **Confirm paid plan status** — verify that the company is on Premium, Business, Enterprise, or Enterprise+, not the free plan. 2. **Confirm DPA is active** — review the Asana subscription terms to confirm the DPA is incorporated; for Enterprise plans, contact the Asana account team. 3. **Check EU data residency requirement** — if data localisation is required, confirm that Enterprise or Enterprise+ is in scope and the feature is activated. 4. **Review subprocessor list** — check the current subprocessor list and set up notifications for changes. 5. **Assess BetrVG implications** — if employees’ task data will be tracked, assess whether a works council agreement is needed before rollout. 6. **Update Records of Processing Activities** — add Asana and its subprocessors to the company’s Article 30 GDPR records. 7. **Document the DPA review** — record the DPA version, the date reviewed, and the outcome of the assessment as part of the internal compliance file. For a broader GDPR vendor assessment framework, see our [GDPR AI vendor assessment checklist](https://compound.law/en-DE/compliance/gdpr-ai-vendor-assessment-checklist/). For questions about Asana AI features and GDPR, see the [Asana AI GDPR guide](https://compound.law/en-DE/tools/asana-ai/). ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Yes. Asana automatically includes a DPA on all paid plans — Premium, Business, Enterprise, and Enterprise+. Free plan users are not covered by a DPA and should not use Asana to process personal data. Asana is GDPR-compliant on all paid plans. The DPA includes Standard Contractual Clauses for EU-to-US data transfers and covers processor obligations under Article 28 GDPR. EU data residency requires Enterprise or Enterprise+. Yes, on Enterprise and Enterprise+ plans. With this option, Asana stores data at rest in EU-based data centers. Lower-tier plans (Business, Premium, Free) use US-based infrastructure, with SCCs covering the transfer. Asana maintains a public subprocessor list and provides 30 days' advance notice of changes. Customers have a contractual right to object to new subprocessors, which is relevant for German companies with strict vendor control requirements. Possibly. If Asana is used to track task completion, deadlines, or workload metrics tied to individual employees, it may trigger co-determination rights under Section 87(1) No. 6 BetrVG. A works council agreement is required before rollout in those cases. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Asana DPA: GDPR Data Processing Agreement for German Companies", "description": "Asana includes a DPA on all paid plans. German companies must verify EU data residency, subprocessors, and BetrVG before processing personal data in Asana.", "image": "https://compound.law/assets/images/tools/tools_4.webp", "datePublished": "2026-04-26T00:00:00.000Z", "dateModified": "2026-04-26T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/asana-dpa/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Asana DPA: GDPR Data Processing Agreement for German Companies", "item": "https://compound.law/en-DE/tools/asana-dpa/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does Asana have a Data Processing Agreement?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Asana automatically includes a DPA on all paid plans — Premium, Business, Enterprise, and Enterprise+. Free plan users are not covered by a DPA and should not use Asana to process personal data." } }, { "@type": "Question", "name": "Is Asana GDPR compliant?", "acceptedAnswer": { "@type": "Answer", "text": "Asana is GDPR-compliant on all paid plans. The DPA includes Standard Contractual Clauses for EU-to-US data transfers and covers processor obligations under Article 28 GDPR. EU data residency requires Enterprise or Enterprise+." } }, { "@type": "Question", "name": "Does Asana offer EU data residency for Germany?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, on Enterprise and Enterprise+ plans. With this option, Asana stores data at rest in EU-based data centers. Lower-tier plans (Business, Premium, Free) use US-based infrastructure, with SCCs covering the transfer." } }, { "@type": "Question", "name": "What subprocessors does Asana use?", "acceptedAnswer": { "@type": "Answer", "text": "Asana maintains a public subprocessor list and provides 30 days' advance notice of changes. Customers have a contractual right to object to new subprocessors, which is relevant for German companies with strict vendor control requirements." } }, { "@type": "Question", "name": "Does Asana require a works council agreement in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "Possibly. If Asana is used to track task completion, deadlines, or workload metrics tied to individual employees, it may trigger co-determination rights under Section 87(1) No. 6 BetrVG. A works council agreement is required before rollout in those cases." } } ] } ] ```