--- title: "Notion DPA and GDPR: Can German Companies Use Notion Compliantly?" description: "Notion DPA, GDPR compliance, EU data hosting, and AVV requirements for German companies. Practical guide for legal, privacy, and IT teams." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/notion-ai/" language: "en" --- ![Notion DPA and GDPR compliance guide for German companies](https://compound.law/assets/images/tools/tools_1.webp) tools # Notion DPA and GDPR: Can German Companies Use Notion Compliantly? 20 April 2026 Short answer Yes, Notion can be used GDPR-compliantly in Germany — provided you execute Notion's Data Processing Agreement (DPA), understand that Notion stores all data in the US with no EU region option, and apply specific controls for Notion AI, which uses OpenAI as a sub-processor. - Execute Notion's DPA before rollout — it covers GDPR Art. 28, SCCs, and sub-processors. - Note that Notion has no EU data region — US-based AWS storage with SCCs is the transfer basis. - Notion AI adds complexity: OpenAI is a sub-processor, requiring a separate AI addendum review. **Yes, Notion can be used GDPR-compliantly by German companies — provided you execute Notion’s Data Processing Agreement (DPA), understand that all data is stored in the US with no EU region available, and apply specific controls when using Notion AI, which routes content through OpenAI as a sub-processor.** For most German businesses, the compliance question is not whether Notion is “GDPR-compliant” in the abstract, but whether your specific rollout — including workspace data categories, transfer documentation, and AI feature governance — is defensible under German data protection law. This guide covers what legal, privacy, and IT teams need to check before deploying Notion and Notion AI in a German company context. For broader context on [data processing agreements under GDPR Art. 28](https://compound.law/en-DE/compliance/data-processing-agreement/), see our dedicated guide. ## Does Notion Have a Data Processing Agreement (DPA)? **Yes. Notion offers a Data Processing Agreement** that covers GDPR Article 28 requirements, Standard Contractual Clauses (SCCs) for EU-to-US data transfers, sub-processor disclosures, and deletion and return commitments. Enterprise customers can negotiate the DPA directly with Notion. Key things legal teams should verify when reviewing Notion’s DPA: - **Correct contracting entity:** Confirm the Notion entity and verify the DPA version that applies to your subscription tier. - **Sub-processor list:** Notion discloses its infrastructure and AI-feature sub-processors. Review the current list and the process for sub-processor updates. - **Notion AI addendum:** Notion AI has **separate data processing terms** beyond the main DPA. If your company uses Notion AI features, you must review and accept this AI-specific addendum — it is not covered by the standard DPA. - **SCC module and annex:** Notion relies on Module Two (controller-to-processor) SCCs for EU–US transfers. Confirm that the relevant Annex II (technical and organisational measures) reflects your actual implementation. - **Deletion and return timelines:** Verify the retention period after contract termination and how data deletion is documented. The DPA is the contractual foundation. But it does not automatically resolve whether your specific workspace, user permissions, and AI use cases fit within a defensible GDPR setup — that is a separate governance question. ## EU Data Hosting and Data Residency **Notion does not offer an EU data region.** As of early 2026, all Notion data — including workspace content, AI-generated outputs, and usage data — is stored in the United States on Amazon Web Services (AWS) infrastructure. This is a material fact for German companies: - **No EU residency option.** Unlike Microsoft 365 or Google Workspace, Notion currently cannot keep data within the EU. Every company using Notion is necessarily relying on a third-country transfer basis. - **SCCs are the applicable transfer mechanism.** Notion uses Standard Contractual Clauses (EU Commission Decision 2021/914) as the legal basis for EU-to-US data transfers. German companies should confirm the applicable SCC module and assess whether a Transfer Impact Assessment (TIA) is advisable for sensitive data categories. - **German supervisory authority position:** The German Data Protection Conference (DSK) and the Federal Commissioner for Data Protection and Freedom of Information (BfDI) have consistently scrutinized US cloud services. The EU–US Data Privacy Framework (effective July 2023) provides an additional transfer basis if Notion is certified — but companies should verify Notion’s current DPF certification status independently and not rely on certification assumptions from prior procurement cycles. - **Sector-regulated companies:** Businesses subject to stricter data residency rules — for example, health data processors under § 22 BDSG, or regulated financial services firms — should separately assess whether US-based storage is compatible with sector-specific requirements, independent of GDPR. For most German companies, US-based storage via SCCs is a workable arrangement. It is, however, a fact that must be explicitly documented in records of processing activities (ROPA) and cannot be treated as a default assumption. ## Notion AI — Additional GDPR Considerations Notion AI — the AI-powered writing, search, and summarization features built into Notion workspaces — adds a distinct layer of GDPR complexity beyond the base Notion product. **OpenAI is a sub-processor for Notion AI.** When employees invoke Notion AI functions — drafting, search, Q\&A, summaries — content may be routed through OpenAI under Notion’s sub-processor arrangement. This has several practical implications: 1. **Separate data terms apply.** The standard Notion DPA does not fully govern Notion AI processing. Review and accept the Notion AI data addendum specifically. The sub-processor chain (Notion → OpenAI) and the specific data processing activities covered must be understood before enabling AI features. 2. **Training data policy — a stated commitment, not a legal guarantee.** Notion’s documentation states that customer workspace data is not used to train AI models. This is a helpful procurement point. It should be verified at contract time and on renewal, not treated as a permanent given. 3. **DPIA trigger under GDPR Art. 35.** If your Notion AI rollout involves systematic processing of employee data, large-scale processing of personal data, or categories creating a high privacy risk, a Data Protection Impact Assessment (DPIA) may be required under GDPR Art. 35. This is particularly relevant for use cases involving HR files, customer data, or confidential legal documents. 4. **Workspace-level AI controls.** Enterprise Notion plans allow AI features to be enabled or disabled at the workspace or team level. Before rollout, confirm granular control availability and document which teams have Notion AI features enabled. The risk with Notion AI for German companies is less about the AI feature itself and more about **the breadth of personal data that AI search and summarization can reach** across a permissive workspace. Restricting Notion AI to content areas with low personal data exposure is usually the most defensible first configuration. For comparison with how similar tools handle these questions, see the guides for [Slack AI](https://compound.law/en-DE/tools/slack-ai/), [Microsoft Teams Copilot](https://compound.law/en-DE/tools/teams-copilot/), and [HubSpot Breeze AI](https://compound.law/en-DE/tools/hubspot-breeze-ai-gdpr/). ## BetrVG and Works Council Requirements In Germany, deploying workplace tools that affect how employee work is monitored, organized, or evaluated triggers co-determination rights under the **Betriebsverfassungsgesetz (BetrVG)**. **§ 87(1) no. 6 BetrVG** gives works councils the right to co-determine the use of technical equipment that enables monitoring of employee behavior or performance. This provision applies broadly. Tool introductions are regularly subject to works council consultation or agreement even when the primary purpose is productivity rather than monitoring. For Notion specifically, works council assessment should address: - **Workspace activity data:** Notion can generate activity metadata — who viewed, edited, or created pages. If managers or HR can access this data, co-determination concerns arise. - **Notion AI interaction patterns:** AI feature usage logs, if accessible at an administrative level, can create indirect visibility into employee work habits and content choices. - **Work organisation changes:** Introducing Notion AI as a core knowledge management or planning tool changes work organisation — a classic co-determination trigger under § 87(1) no. 6 BetrVG. **Practical recommendation:** Engage the works council early, before company-wide rollout. The earlier co-determination is addressed, the less likely it is to delay deployment. If a **Betriebsvereinbarung** (works agreement) is required, it should specify: permissible use cases, which analytics are visible to management, retention periods for activity data, and prohibited prompt content categories. For additional context on how German employment law intersects with AI tools, see our [AI employee monitoring compliance](https://compound.law/en-DE/compliance/ai-employee-monitoring/) guide. ## Legal Basis for Processing Under GDPR Art. 6 Before deploying Notion and Notion AI, your company must identify the **legal basis for processing** under GDPR Art. 6 for each data category that may enter the workspace. | Processing activity | Data involved | Likely legal basis | | ------------------------------------------------ | -------------------------------------------- | ------------------------------------------------------------------ | | Internal documentation and project collaboration | General business data, minimal personal data | Art. 6(1)(f) legitimate interests | | Employee workspace and knowledge management | Employee names, roles, work product | Art. 6(1)(b) employment contract or Art. 6(1)(f) | | Customer data in workspace (accounts, support) | Customer names, contacts, business data | Art. 6(1)(b) contract with customer, or Art. 6(1)(f) | | HR data (onboarding, evaluations, absences) | Employee personal data | Art. 6(1)(b) + § 26 BDSG (employee data) | | Special category data (health, union membership) | Sensitive data under GDPR Art. 9 | Art. 9(2) exception required — explicit consent or statutory basis | **Data minimisation obligations:** Even where a legal basis exists, GDPR Art. 5(1)(c) requires that personal data be adequate, relevant, and limited to what is necessary. Companies should not allow HR files, medical records, or detailed customer PII into a broad Notion workspace simply because a DPA has been executed. The legal basis and the data minimisation assessment must be conducted together. For German companies, **§ 26 BDSG** governs the processing of employee data. The threshold for what constitutes legitimate processing of employee data is generally stricter under German employment law than a GDPR Art. 6(1)(f) analysis alone would suggest. Compound Law’s [expertise overview](https://compound.law/en-DE/expertise/) explains how these intersecting frameworks are reviewed in practice. ## Risk Levels by Use Case | Use case | Typical data | Risk level | Review needed | | ------------------------------------------- | ------------------------------------------------ | -------------- | ------------------------------------------------------------------- | | Drafting internal meeting notes | General business information | Low | Standard DPA and policy review | | Summarising product documentation | Internal technical material | Low | Access-control check and user guidance | | Searching a general company wiki | Mixed internal knowledge, possible personal data | Medium | Permission review and data-minimisation rules | | Sales or customer-success workspace | Customer names, account context, support details | Medium to high | Contract review, data category review, transfer check | | HR onboarding and people-operations support | Employee data, evaluations | High | Narrow permissions, HR review, works council and DPIA assessment | | Contract review or legal investigations | Confidential legal data, dispute material | High | Case-by-case legal approval; generally not suited for broad rollout | ## Practical Compliance Checklist Before Rollout Before enabling Notion — and especially Notion AI — company-wide, work through these steps across legal, privacy, IT, and operations: 1. Execute the **Notion DPA** and confirm the correct entity, sub-processor list, and SCC module. 2. Review and accept the **Notion AI addendum** — this is separate from the main DPA. 3. Document the **transfer basis** (SCCs) in your ROPA; assess whether a Transfer Impact Assessment is appropriate. 4. **Map workspace data categories** — identify which personal data (employee, customer, HR, special category) is already in or will enter the workspace. 5. Establish **data minimisation rules** — define what personal data may and may not be entered into Notion. 6. **Review access permissions** — restrict guest access, external sharing, and cross-team content visibility. 7. Assess whether a **DPIA** is required under GDPR Art. 35 for Notion AI applied to sensitive data. 8. **Engage the works council** early; prepare a Betriebsvereinbarung if co-determination applies. 9. Define **approved, restricted, and prohibited AI use cases** across teams. 10. **Train employees** on what may never enter Notion AI prompts — HR files, customer PII, litigation documents. ## How Compound Law Helps Compound Law supports German and DACH companies with Notion DPA and AI addendum review, Transfer Impact Assessments, DPIA analysis for Notion AI use cases, Betriebsvereinbarung drafting for works council engagement, and practical rollout documentation for legal, privacy, and operations teams. Typical engagements include: - Notion DPA and AI addendum review, - GDPR transfer documentation and TIA, - DPIA for Notion AI high-risk processing scenarios, - Works council strategy and Betriebsvereinbarung drafting, - Internal AI governance policies and use-case matrices, - Rollout guidance for legal, privacy, and operations stakeholders. Specific situations require individual legal advice. This guide structures the review but does not substitute for a fact-specific assessment of your workspace, contracts, and actual data flows. ## Frequently Asked Questions ### Is Notion GDPR compliant for German companies? Yes, Notion can be used in a GDPR-compliant way in Germany. Compliance depends on executing the Notion DPA, documenting the US-based data storage via SCCs, reviewing Notion AI’s OpenAI sub-processor relationship, and applying appropriate workspace governance for personal data categories. ### Does Notion offer a Data Processing Agreement (DPA)? Yes. Notion provides a Data Processing Agreement covering GDPR Art. 28, standard contractual clauses for EU–US transfers, and sub-processor disclosures. A separate AI-specific data addendum applies if Notion AI features are used and must be reviewed independently. ### Does Notion store data in the EU? No. As of early 2026, Notion has no EU data region. All workspace data is stored in the United States on AWS infrastructure. EU and German companies use Standard Contractual Clauses (SCCs) as the legal basis for the EU-to-US data transfer. ### Can I use Notion AI if I have GDPR obligations? Yes, but with additional care. Notion AI uses OpenAI as a sub-processor. You must review the Notion AI data addendum, assess whether a DPIA is required for your intended use cases, and consider restricting AI features for workspaces containing employee, customer, or confidential legal data. ### What do I need to check before deploying Notion company-wide in Germany? Execute the DPA and AI addendum, map workspace data categories, document the SCCs for the US transfer basis, assess DPIA requirements, engage the works council early, define approved and prohibited AI use cases, and train employees on what may not enter Notion AI prompts. ### Do I need works council approval to deploy Notion in Germany? Not automatically, but an early co-determination assessment is strongly recommended. Under § 87(1) no. 6 BetrVG, works councils have co-determination rights for technical tools that can record or evaluate employee behavior or performance. Notion’s activity metadata and Notion AI interaction logs can create monitoring-adjacent scenarios that should be addressed before company-wide deployment. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Yes. Notion provides a DPA covering GDPR Art. 28, standard contractual clauses for EU–US transfers, and sub-processor disclosures. For enterprise customers, the DPA can be negotiated. Notion AI has a separate addendum that must also be reviewed. Yes, if properly configured. You need to execute the DPA, account for US-based data hosting via SCCs, review Notion AI's OpenAI sub-processor relationship, and restrict high-risk use cases involving employee or customer data. No. As of early 2026, Notion does not offer an EU data region. Data is stored in the US on AWS infrastructure. The transfer basis for EU companies is Standard Contractual Clauses (SCCs). Yes, but with additional review. Notion AI uses OpenAI as a sub-processor. You must review the AI-specific data addendum, consider a DPIA for high-risk use cases, and restrict AI features for sensitive employee and customer data. Often yes, or at least an early assessment is recommended. Works council co-determination under § 87(1) no. 6 BetrVG can apply if Notion monitors or changes employee work patterns. For general business collaboration, Art. 6(1)(f) legitimate interests typically applies. For employee data, Art. 6(1)(b) combined with § 26 BDSG governs. Customer data in workspaces requires its own legal basis analysis depending on the data categories involved. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Notion DPA and GDPR: Can German Companies Use Notion Compliantly?", "description": "Notion DPA, GDPR compliance, EU data hosting, and AVV requirements for German companies. Practical guide for legal, privacy, and IT teams.", "image": "https://compound.law/assets/images/tools/tools_1.webp", "datePublished": "2026-04-20T00:00:00.000Z", "dateModified": "2026-04-20T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/notion-ai/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Notion DPA and GDPR: Can German Companies Use Notion Compliantly?", "item": "https://compound.law/en-DE/tools/notion-ai/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does Notion offer a Data Processing Agreement (DPA)?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Notion provides a DPA covering GDPR Art. 28, standard contractual clauses for EU–US transfers, and sub-processor disclosures. For enterprise customers, the DPA can be negotiated. Notion AI has a separate addendum that must also be reviewed." } }, { "@type": "Question", "name": "Is Notion GDPR compliant for German companies?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, if properly configured. You need to execute the DPA, account for US-based data hosting via SCCs, review Notion AI's OpenAI sub-processor relationship, and restrict high-risk use cases involving employee or customer data." } }, { "@type": "Question", "name": "Does Notion store data in the EU?", "acceptedAnswer": { "@type": "Answer", "text": "No. As of early 2026, Notion does not offer an EU data region. Data is stored in the US on AWS infrastructure. The transfer basis for EU companies is Standard Contractual Clauses (SCCs)." } }, { "@type": "Question", "name": "Can I use Notion AI if I have GDPR obligations?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, but with additional review. Notion AI uses OpenAI as a sub-processor. You must review the AI-specific data addendum, consider a DPIA for high-risk use cases, and restrict AI features for sensitive employee and customer data." } }, { "@type": "Question", "name": "Do I need works council approval to deploy Notion in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "Often yes, or at least an early assessment is recommended. Works council co-determination under § 87(1) no. 6 BetrVG can apply if Notion monitors or changes employee work patterns." } }, { "@type": "Question", "name": "What is the legal basis for using Notion under GDPR Art. 6?", "acceptedAnswer": { "@type": "Answer", "text": "For general business collaboration, Art. 6(1)(f) legitimate interests typically applies. For employee data, Art. 6(1)(b) combined with § 26 BDSG governs. Customer data in workspaces requires its own legal basis analysis depending on the data categories involved." } } ] } ] ```