Version: 10 September 2026 - prepared by WAIMAKERS B.V.

Executive summary

Notion AI can support a GDPR-compliant deployment under Notion's commercial terms, but this depends on the plan, enabled AI features, subprocessors, permissions, retention and residency configuration. The service is not itself a GDPR certification.

Is Notion AI GDPR compliant?

Not automatically. Notion's DPA, no-training default and security controls can support the customer's compliance programme. Lawful basis, minimisation, transparency, permissions, retention, transfers and any DPIA remain customer responsibilities.

What is supported

✅ Notion says it and its AI subprocessors do not use Customer Data to train models by default.
✅ Enterprise LLM providers use zero data retention by default.
✅ Notion AI is in scope for Notion's SOC 2 Type 2 report and ISO 27001 certification.
✅ Notion AI respects existing workspace permissions.
✅ Customer Data sent to AI subprocessors uses TLS 1.2 or later in transit.

What still needs review

⚠️ Zero retention applies to the LLM provider, not to all Notion data.
⚠️ Existing oversharing can make content discoverable through AI.
⚠️ Some data-retaining features and External Agents have separate practices.
⚠️ EU residency requires a completed migration and only covers listed data at rest.
⚠️ Web search, connectors, Custom Agents and External Agents create separate data flows.

Tiers at a glance (EU focus)

Route	Training and AI providers	LLM-provider retention	EU data residency	Practical assessment
Non-Enterprise workspace	✅ No training on Customer Data by default. Notion uses hosted models and organisations such as OpenAI and Anthropic; verify the current subprocessor list.	⚠️ By default, 30 days or fewer. Some data-retaining features are off by default and admins receive a setting. External Agents differ.	❌ No regional-at-rest commitment is documented; default hosting is the US.	Assess the exact plan and enabled features before processing sensitive data.
Enterprise without completed migration	✅ Same no-training default	✅ Enterprise LLM providers use zero retention by default	❌ Workspace data remains in the US until Notion confirms the requested migration is complete.	Do not infer EU residency from the Enterprise plan alone.
Enterprise with confirmed EU residency	✅ Zero-retention LLM providers by default; DPA and live subprocessor list still apply	⚠️ Workspace content, embeddings and deleted pages have separate lifecycles	✅ Listed Customer Data at rest is in Frankfurt, with Ireland backup. Processing and excluded products can remain international.	Stronger at-rest control, with documented product and processing limits.

Public prices and AI packaging change by market, billing cadence and contract. Verify Notion's live pricing and order form before purchase.

How Notion AI processes data

A user's permissions determine which workspace content Notion AI can access.
Notion can route a request to Notion-hosted models or AI providers such as Anthropic and OpenAI.
The LLM-provider retention rule depends on the plan and enabled feature.
Notion separately stores workspace content and embeddings.
Connectors, web search and agents can add other processors and locations.

Retention and deletion

✅ Enterprise LLM providers use zero data retention by default.
⚠️ Non-Enterprise LLM providers retain Customer Data for no more than 30 days by default.
⚠️ Some features require a data-retaining LLM and have separate admin settings.
✅ The OpenAI embeddings API used by Notion is zero-retention.
⚠️ Notion stores the resulting embeddings in a vector database and deletes them within 60 days after the page or workspace is deleted.
⚠️ Deleted pages and workspaces remain recoverable for 30 days before becoming unrecoverable, subject to applicable contract or legal exceptions.

EU data residency

EU residency is not automatic with Enterprise. Migration must be requested and completed. Until Notion confirms completion, workspace data remains hosted in the US.

For a completed EU migration, listed Customer Data at rest is stored in AWS Frankfurt with backup in Ireland. This includes page content, uploaded files, the Customer Data search index and stored third-party or bot messages. Notion says US copies of covered data are deleted about 30 days after migration.

The commitment does not cover account information, usage data, subprocessor processing, Notion Calendar, Notion Mail, beta services, integrations or non-Notion services. Processing can still occur in the US and other countries.

EU rollout checklist

Confirm the plan, current DPA, Master Subscription Agreement and live subprocessor list.
Record which AI functions, web search, connectors and agents are enabled.
If EU residency is required, obtain confirmation that migration is complete and record the covered data categories.
Document LLM-provider retention separately from workspace, deletion and embedding retention.
Remediate permissions and apply least privilege before enabling workspace-wide search.
Test deletion, restore and export workflows, including embeddings and integrated services.
Set an approved-data policy and complete the lawful-basis, transparency, DPIA and transfer assessment required by the use case.

Notes and caveats

⚠️ OpenAI and Anthropic are examples of providers, not a complete fixed list.
⚠️ A certification supports a controls assessment but does not certify the customer's GDPR compliance.
⚠️ HIPAA statements have their own contract and configuration conditions.
⚠️ Connectors and third-party data do not automatically remain within Notion's EU at-rest region.

Sources

Disclaimer

This overview is an informational procurement aid, not legal advice or certification of a workspace. Verify the live plan, contract, settings and data flows before production use. The customer remains responsible for its GDPR obligations.

Prepared and issued by WAIMAKERS B.V. - 10 September 2026.

Notion AI

Compare related tools

Need help navigating AI?

Notion AI

Compare related tools

Need help navigating AI?