Is Notion AI GDPR-Compliant? Examples, Costs and How to Start

“Is Notion AI GDPR-compliant?” is the question that lands on the managing director’s desk the moment someone in sales asks Notion AI to summarise a workspace full of customer notes with names, phone numbers and deal values. Notion Labs is a US company, the default hosting is in Oregon, and the data protection officer wants to know what happens to that personal data the second it leaves the workspace. This article answers it plainly, as of October 2026: what the GDPR requires, which Notion plans give you a data processing agreement and EU data residency, what Notion’s own help pages actually say about sub-processors, and the European way to get the work done without the personal data ever leaving Europe. This is not legal advice - confirm the details with your own data protection officer.

Is Notion AI GDPR-compliant?

Notion AI is not automatically GDPR-compliant, but it can be used in a GDPR-compliant way on the right plan with the right setup. Whether a given use is compliant depends on three things you control: the plan (Free and Plus only offer a Notion AI trial and have no business data processing agreement, Business signs a DPA and excludes your data from model training by default, Enterprise adds EU data residency in Frankfurt and zero data retention with the LLM providers), where the data is processed (default is US-West-2 in Oregon; EU residency on Enterprise still allows sub-processors to process data outside the region), and your own paperwork (a lawful basis under Art. 6 GDPR, a signed DPA under Art. 28, a record of processing, a DPIA where needed and a Chapter V check for the US transfer). A note tool cannot make you compliant; it can only give you the terms you need to be¹²⁵.

The GDPR-compliant way with Superkind

The quickest way to stay on the right side of the GDPR is to keep the personal data in Europe from the start. Superkind is the AI employee for your team: you write to Superkind in Outlook or any email, Microsoft Teams, Slack or the Superkind web app like you would to a colleague, and it does the task in your programs through 1,500+ integrations such as SharePoint, HubSpot, DATEV and Zendesk. Superkind is hosted and processed in Europe, GDPR compliant, aligned with the EU AI Act and never trains models on your data. It works with AI models from OpenAI, Anthropic, Mistral and Google, all processed in Europe, and the data processing agreement comes through the Trust Center.

1. 1

   You write the task

   In Outlook, Teams, Slack or the web app, in plain words: “Summarise the Berger account notes and draft the follow-up for Friday.” No customer data copied into a US workspace.

2. 2

   Superkind does it in your systems

   It pulls the notes from SharePoint or HubSpot, uses your company knowledge (the account, past calls, your policy) and follows your rules, such as “Any discount over 10 percent needs sign-off from sales management”. The personal data stays in Europe the whole time.

3. 3

   Superkind asks before anything goes out

   You get the draft with Approve or Reject. Nothing is sent, booked or changed without your OK, and your colleague can approve in Teams or Slack, wherever they work.

4. 4

   Next time it runs as a routine

   What you explain once keeps running, for example “Every Monday, summarise the open accounts and flag the risks”. Every task adds to your Company Brain, and that knowledge stays when people leave.

How Notion AI and the GDPR fit together

The GDPR does not ban Notion AI. It puts duties on you, the company, as the controller of the personal data. Six parts decide whether a given use is compliant.

1. You are the controller, and you need a lawful basis - when you put a customer’s or employee’s personal data into any tool, you need a legal ground under Art. 6 GDPR, usually a contract, a legal obligation or legitimate interest after a balancing test. Special categories such as health or union data need an extra basis under Art. 9⁶.
2. Where the data is processed - by default Notion runs on AWS US-West-2 (Oregon). EU data residency in Frankfurt (eu-central-1, backup Ireland) is available on the Enterprise plan only. Even there, Notion’s own help page states that customer data processed by sub-processors, including the LLM providers for Notion AI, can still be processed outside the chosen data region².
3. The data processing agreement (DPA, or AVV in German) - Art. 28 GDPR requires a processing contract with any provider that handles personal data for you. Notion signs a DPA on business plans; the Free trial is not set up for a controller DPA by default⁷.
4. Training on your data - Notion’s AI safety page says it does not use workspace data to train its models and that sub-processor contracts prohibit training on customer data. There is one opt-in exception, the AI LEAP Program, where a customer can share workspace data in return for early access³.
5. Record of processing and DPIA - you log the processing in your record of processing activities (Art. 30) and run a data protection impact assessment (Art. 35) when the use is likely to be high risk, such as large-scale processing of personal data or automated decisions with real effects on people⁸⁹.
6. The Chapter V check for the US transfer - because Notion Labs is a US company and processing by sub-processors can leave the chosen data region, you also check the international transfer under Chapter V of the GDPR (Art. 44 onwards), typically on the EU-US Data Privacy Framework and the Standard Contractual Clauses in the DPA¹⁰.

Notion AI tiers and the GDPR compared

This table shows how each Notion plan stands on the points that decide GDPR fit for Notion AI, with Superkind in the first row for comparison. It is a plan-level summary, not a compliance sign-off: your own lawful basis and documentation still apply.

As of October 2026. Notion sources: pricing page⁵, data residency help², Notion AI security practices¹. Confirm the current terms for your account with Notion and your data protection officer.

The short version: the plans people reach for first (Free and Plus) are the weakest fit for personal data, Business signs a DPA but keeps the data in the US, and Enterprise with Frankfurt residency is the only Notion setup that stores the content in Europe at rest. The LLM calls that power Notion AI are still processed by OpenAI and Anthropic in the USA. Superkind starts from the European side of all of this.

Examples: Notion AI and the GDPR in practice

Five realistic setups, from the whole team in Europe to a sales-assisted Enterprise migration. Each shows what you would need to do to stay compliant.

1. The whole team works GDPR-compliant with Superkind

Daniel in sales writes to Superkind in Teams: “Summarise the Berger account notes and draft the follow-up.” Superkind pulls the notes from SharePoint and HubSpot, drafts the email with your policy, and asks Daniel for approval before it goes out. The personal data is processed in Europe the whole time, there is no training on it, and the DPA is in place through the Trust Center. Superkind works with models from OpenAI, Anthropic, Mistral and Google, processed in Europe, and connects through 1,500+ integrations such as HubSpot, Zendesk and DATEV. See the AI sales rep for how this runs in sales operations. As of October 2026 you start for free with a one-off up to EUR 150 in credits.

2. One person on Notion Plus with the AI trial

The founder uses Notion Plus at $10 per member/month to keep company notes and tries Notion AI on the included trial⁵. That is fine for general notes, but Plus is not set up for a controller DPA by default, there is no EU data residency, and the AI trial should not touch customer lists, invoices with personal data or employee records.

3. A small team on Notion Business

Fifteen colleagues get Notion Business seats at $20 per member/month, which includes Notion Agent, AI Meeting Notes and Enterprise Search beta⁵. Business signs a DPA and excludes your data from model training by default, so it can be used with personal data once you sign the DPA, set the controls and document the US transfer. The open point is processing location: Business has no EU data residency, so the data is still handled primarily in Oregon.

4. Notion Enterprise with Frankfurt residency

A larger organisation sets up a new Enterprise workspace with EU-Central-1 (Frankfurt) as the data region, signs the DPA, runs a DPIA and adds AI literacy training²⁹. Page content, uploaded files, the search index and bot files are stored at rest in Europe, and the LLM providers run with zero data retention. The caveat Notion itself names: AI inference by sub-processors can still happen outside the data region, so the record of processing has to reflect that.

5. Enterprise migration for an existing workspace

A team has used Notion Business for two years and books the sales-assisted migration to the EU region². Until the migration is confirmed by the account team, the workspace stays in the US; afterwards it moves to Frankfurt. Not all data moves: user account information, usage data, Notion Calendar, Notion Mail and Beta Services stay outside the region, which the data protection officer has to list in the record of processing.

What GDPR-compliant AI needs (and what it costs)

Whichever tool you choose, the GDPR gives you the same short checklist. None of it is automatic on any plan.

• A lawful basis - name your ground under Art. 6 for each use, and an extra basis under Art. 9 for special categories such as health or union data⁶.
• A data processing agreement - sign the DPA (AVV) under Art. 28 with the provider before personal data goes in. Available on Notion Business and Enterprise, and through the Trust Center for Superkind⁷.
• Known processing location - know where the data is processed. EU residency on Notion Enterprise (with the AI caveat); in Europe by default for Superkind².
• No training on your data - off by default on Notion for all plans and never done by Superkind; make sure nobody opts into the AI LEAP Program by accident³.
• Record of processing, DPIA and Chapter V check - log the processing (Art. 30), run a DPIA (Art. 35) where the risk is high, and document the US transfer under Chapter V where it still happens⁸⁹¹⁰.
• AI literacy - train staff and set rules under Art. 4 of the EU AI Act¹¹.

Data protection and EU hosting

Safe by default

Your data stays in Europe, under a DPA, with no training on your data.

• Hosted and processed in Europe
• GDPR compliant
• Aligned with the EU AI Act
• No training on your data
• DPA through the Trust Center

For a sales follow-up with a customer’s name and account value, a workspace full of applicant profiles or an invoice with a person’s details, the processing location and the DPA are the whole ball game. Superkind keeps that personal data in Europe by default, so you spend your time on the lawful basis and the record, not on routing the data back out of the US.

What Superkind costs

As of October 2026. Prices excl. VAT, for the whole company with unlimited users.

• Free - EUR 0 with a one-off up to EUR 150 in credits to start. No credit card, no sales call, every feature and every connection, in Slack, Teams, email and the app, hosted in the EU.
• Business - from EUR 50 per month for 25,000 credits. EUR 100 for 50,000 credits is the popular step, then EUR 200 and EUR 500. No price per seat, unused credits carry over one month, custom apps included, cancel monthly.
• Enterprise - custom price for your volume, dedicated support with SLA, SSO/SCIM and audit log, a DPA and help with the security review, payment by invoice.
• What credits buy - a question uses 10-50 credits, a task 50-500 credits and a run of your own agent 1,000-5,000 credits. EUR 100 covers up to 1,000 tasks or 5,000 questions.

How to start

You can set the ground rules in an afternoon. Three steps:

From the first task to your own app

With Superkind, the data stays in Europe from the first task to the app you build later. Four stages, on the sales example from above:

1. 1

   Ready in minutes

   Sign up for free with up to EUR 150 in credits, send the first task in Teams, Slack or by email (“Summarise the Berger account notes”) and watch it get done, with the personal data processed in Europe.

2. 2

   Tasks become routines

   What you explain once keeps running as a routine, for example “Every Monday, summarise the open accounts and flag the risks”. Before anything goes out, Superkind asks for approval.

3. 3

   Learns from day one

   Every task makes Superkind smarter. Your accounts, past calls and tone of voice end up in your Company Brain, and that knowledge is never lost, even when people leave.

4. 4

   Your own app, without starting over

   When sales gets more complex, you build custom solutions, apps and integrations on the platform, on top of what Superkind already knows, for example your own account review app with its own approvals: your Super App. Built yourself or together with us. It all belongs to you.

Conclusion

Notion AI is not GDPR-compliant out of the box, but it can be used compliantly: pick Notion Business or Enterprise for a DPA and the training opt-out, use Enterprise with Frankfurt residency for EU data at rest, and keep the lawful basis, the record of processing, the DPIA and the Chapter V check on your side (as of October 2026). The AI inference itself still runs with OpenAI and Anthropic in the USA, which has to be in your record. If you want the personal data to stay in Europe from the first task without that setup work, Superkind is hosted in Europe, never trains on your data, provides its DPA through the Trust Center, and runs the task in Outlook, Teams, Slack, SharePoint, HubSpot or your CRM through 1,500+ integrations. Write down the rule for staff this week, then send Superkind one real task and compare.

Frequently Asked Questions

Henri Jung

Co-founder of Superkind, the AI employee teams write to in Outlook, Teams and Slack. Henri helps companies, from small teams to the Mittelstand, hand their routine work to AI - without new tools, consultants or an in-house AI team.