Zapier and GDPR

GDPR, and the UK GDPR, set the rules for handling personal data. When you use Zapier, Zapier processes personal data for you, so it acts as your data processor and you stay the controller.

Zapier's Data Processing Addendum is part of its terms of service, so it applies to your account. Zapier hosts its data on AWS servers in the US, and its subprocessors may process some data elsewhere. There's no EU or UK only option.

To make those transfers lawful, Zapier takes part in the EU-US Data Privacy Framework and its UK Extension, with Standard Contractual Clauses and the UK Addendum as a backup. Zapier also publishes a list of its subprocessors.

Whether your use of Zapier is compliant still depends on you: what data you send, why, for how long, and whether your privacy notice says so. This isn't legal advice, so check anything sensitive with your data protection adviser.

Before I build, I ask what personal data each Zap will touch and whether it needs to. Often a Zap only needs an ID or a name, not a full record, so I pass less.

I keep sensitive data like health or right-to-work details out of Zaps unless there's a clear reason, build in the client's own account, and note in the handover doc what data flows where. That makes the client's records of processing much easier to keep up to date.

1. Data List the personal data each step uses Map
2. Need Remove any field the Zap doesn't need Minimise
3. Notice Check your privacy notice covers the use Transparency
4. Record Add the Zap to your records of processing Document