Skip to main content
Drata logo

Drata

GDPR evidence

Drata’s AI-native compliance automation & agentic trust management platform powers GRC and assurance (GRC +A) for startups, mid-size

drata.comCompliance and GRCLast verified 1 Nov 2026
Request the report Are you Drata?
GDPR mark, CertReports state Vendor-stated as of 1 Nov 2026Vendor-stated

Drata and GDPR

Drata states it holds a data processing agreement. CertReports captured this on 1 Nov 2026 from its trust centre (Drata); it is a vendor statement, not an independent confirmation.

Evidence

Vendor-statedVendor states GDPR on its trust centre
as of 1 Nov 2026 · confidence 80%
SourceCapturedQuoteLinks
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
1 Nov 2026GDPR
Live page Snapshotsha256 32b863fb4d
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
31 Oct 2026GDPR
Live page Snapshotsha256 257bdc4dd6
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
29 Oct 2026GDPR
Live page Snapshotsha256 42d21666d8
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
27 Oct 2026GDPR
Live page Snapshotsha256 372a269010
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
25 Oct 2026GDPR
Live page Snapshotsha256 3c152066c6
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
23 Oct 2026GDPR
Live page Snapshotsha256 38d298353e
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
21 Oct 2026GDPR
Live page Snapshotsha256 0b4770188c
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
19 Oct 2026GDPR
Live page Snapshotsha256 94d9e5d837
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
17 Oct 2026GDPR
Live page Snapshotsha256 f5d72290a8
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
15 Oct 2026GDPR
Live page Snapshotsha256 f314853efe
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
13 Oct 2026GDPR
Live page Snapshotsha256 56823a70f3
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
11 Oct 2026GDPR
Live page Snapshotsha256 7acb0aa487
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
9 Oct 2026GDPR
Live page Snapshotsha256 faf250cb51
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
7 Oct 2026GDPR
Live page Snapshotsha256 7f487a3e85
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
5 Oct 2026GDPR
Live page Snapshotsha256 ed218fded1
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
3 Oct 2026GDPR
Live page Snapshotsha256 961b9132ce
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
1 Oct 2026GDPR
Live page Snapshotsha256 8ec05bbb56
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
29 Sep 2026GDPR
Live page Snapshotsha256 8c4820ee22
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
27 Sep 2026GDPR
Live page Snapshotsha256 af8be11579
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
25 Sep 2026GDPR
Live page Snapshotsha256 b825f4421e
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
21 Sep 2026GDPR
Live page Snapshotsha256 499817bcbc
Drata trust centre (Drata)
Vendor trust centre · HTTP 200
17 Sep 2026GDPR
Live page Snapshotsha256 cc367178b7
This is wrong
VerifiedActive: SW-US Certification, EU-US Certification, UK Extension Certification
as of 26 Oct 2026 · confidence 100%
Kind
Listing
Issued or listed
5 May 2022
Expires or valid through
14 Apr 2027
Scope
[Non-HR Data] Drata provides a software-as-a-service platform that our enterprise customers use to manage the governance, risk and compliance aspects of their businesses. In providing this platform, Drata processes data our customers submit to our services or instructs us to process on their behalf. While Drata's customers decide what data to submit, it typically includes information about their governance, risk and compliance programs, and contact information and billing information. Drata uses certain third-party service providers (“sub-processors”) to assist us in providing our services to customers. These third parties may access, process, or store personal data in the course of providing their services. Drata maintains contracts with these third parties restricting their access, use and disclosure of personal data in compliance with our Data Privacy Framework obligations. In addition, Drata processes personal data about EEA, UK and Swiss website visitors and EEA, UK and Swiss business contacts to provide the services requested, conduct business related tasks and to communicate with these individuals. Drata may disclose personal data to Drata's other corporate entities, third party service providers, partners and other related entities. [HR Data] Drata processes personal data about EEA, UK and Swiss employees and job applicants to manage all aspects of the employment relationship in compliance with our Data Privacy Framework obligations. Drata may disclose personal data to Drata's other corporate entities, third party service providers and government entities. Drata’ Privacy Notice for Drata Employment Candidates is provided on Drata’s website and describes how Drata collects, uses, discloses, transfers, and stores personal data as part of our recruitment process.
SourceCapturedQuoteLinks
Data Privacy Framework list
Official registry · HTTP 200
26 Oct 2026Drata: Active: SW-US Certification, EU-US Certification, UK Extension Certification
Live pagesha256 b68827d007
This is wrong
ExpiredInactive
as of 26 Oct 2026 · confidence 100%
Kind
Listing
Issued or listed
24 May 2017
Scope
VoiceThread is an online service that allows users to share and discuss digital media. The basic service structure is similar to wiki platforms or blogging platforms. Users upload media that we store and then distribute and make available to whomever the user determines should have access to it. The audience for that media is then given an opportunity to make comments about the media asynchronously, and a conversation takes place over time. VoiceThread collects first name, last name, and email address. These items are used to provision user accounts and identify them when they create content. Users may opt to go by an alias rather than real first and last name. VoiceThread utilizes Amazon Web Services as a datacenter, but user information is not shared with any other third party.
SourceCapturedQuoteLinks
Data Privacy Framework list
Official registry · HTTP 200
26 Oct 2026VoiceThread: Inactive
Live pagesha256 02e7063213
This is wrong
What GDPR means, and what it does not

"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.

Read the GDPR guide and browse all vendors with evidence

Questions buyers ask

Is Drata GDPR compliant?

There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.

How does CertReports verify this?

Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.

Change history

  1. 22 Sep 2026DPA changedThe data processing agreement URL changed.
  2. 17 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.

Alternatives with GDPR evidence

Similar vendors (shared product tags or the Compliance and GRC category) whose GDPR row is verified or vendor-stated, ranked by similarity.

Vanta logo

Vanta

Compliance and GRC

Vanta—the proven leader in automated compliance helping startups…

SOC 2 mark, CertReports state Vendor-statedGDPR mark, CertReports state Vendor-statedFedRAMP mark, CertReports state VerifiedPCI DSS mark, CertReports state Vendor-statedISO 27001 mark, CertReports state Vendor-statedCSA STAR mark, CertReports state Verified
3 verified · 9 stated1 Nov 2026
SafetyKit logo

SafetyKit

Compliance and GRC

AI agents for risk, compliance, and safety

HIPAA mark, CertReports state Vendor-statedSOC 2 mark, CertReports state Vendor-statedGDPR mark, CertReports state Vendor-stated
3 stated21 Sep 2026
Diligent logo

Diligent

Compliance and GRC

Diligent's trusted GRC software helps boards and leaders clarify risk, elevate governance, and manage compliance in one secure, AI-powered

HIPAA mark, CertReports state Vendor-statedSOC 2 mark, CertReports state Vendor-statedGDPR mark, CertReports state Vendor-statedFedRAMP mark, CertReports state VerifiedISO 27001 mark, CertReports state Vendor-statedSOC 1 mark, CertReports state Vendor-stated
2 verified · 10 stated1 Nov 2026

Understand GDPR evidence

All articles