Zapier
GDPR evidence
The easiest way to automate your work.
No public evidenceZapier and GDPR
CertReports found no public GDPR evidence for Zapier as of unknown date. This does not mean the vendor is non-compliant. It means CertReports found no public evidence at the last check.
Evidence
- Kind
- listing
- Issued or listed
- 20 Dec 2016
- Expires or valid through
- 14 Jul 2027
- Scope
- Zapier provides an automation platform that enables customers to connect and orchestrate data flows between their chosen online applications. In reliance on the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Zapier processes personal data transferred from the EEA, UK, and Switzerland for the following purposes: to provide, secure, and operate the Zapier service; to execute customer-configured workflows between integrated applications; to provide customer support and account administration; to detect, prevent, and investigate security incidents or abuse; to bill and collect payment; to comply with legal obligations; and to maintain backups, logs, and service reliability. Types of personal data and data subjects. As a service provider (processor) to our customers (controllers), Zapier processes “Customer Data” that customers elect to route through the Zapier platform, which may include identifiers and contact details (e.g., names, email addresses, phone numbers, postal addresses), account and transaction identifiers, and any other personal data that customers configure their workflows to process. As a business (controller) for limited operations, Zapier also processes business contact information for customer/admin users and website/app visitors (e.g., names, emails, company, role), along with service usage, device, and log information needed to operate and secure the service. Zapier does not rely on the DPF for HR/employee personal data transfers. Disclosures/Onward transfers. Zapier discloses personal data only: • At the customer’s direction to the third-party applications the customer selects and connects via Zapier (e.g., when a workflow sends data from one customer-chosen app to another). In these cases, the customer is the controller determining the recipients. • To contracted service providers (sub-processors) that support the Zapier service, such as cloud hosting and storage, security monitoring, customer support/ticketing, communications and email/SMS delivery, payments and billing, analytics/telemetry, logging, and error tracking. These providers are bound by written agreements requiring DPF consistent protections and onward transfer obligations. A current list of sub-processors is available on Zapier’s subprocessors page. • For legal and safety reasons (e.g., to comply with law or lawful requests, or to protect rights, safety, and integrity of the service).
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 17 Sep 2026 | Zapier, Inc.: Active: UK Extension Certification, SW-US Certification, EU-US Certification | Live pagesha256 671628bb35 |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Zapier GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the No-code and automation category) whose GDPR row is verified or vendor-stated, ranked by similarity.
No No-code and automation vendor has GDPR evidence in the index yet.