Data processing agreement (dpa) — Notion Wikis

Cited by

Facts read from this source

• DPA update effective date Report an error

  “Notion has updated its Data Processing Addendum effective August 14, 2026.”

• DPA previous version available Report an error

  “To view the previous version of Notion's Data Processing Addendum, click the link below Data Processing Addendum (Deprecated August 14, 2026)”

• DPA contracting entity Report an error

  “This Data Processing Addendum (“DPA”) forms part of the Master Subscription Agreement (the “Agreement”) between Customer and Notion Labs, Inc. (”Notion”).”

• DPA DPA controls over agreement Report an error

  “If and to the extent language in this DPA or any of its attachments conflicts with the Agreement, this DPA shall control.”

• DPA duration survival Report an error

  “This DPA will become binding upon the effective date of the Agreement and shall survive until expiration or termination of the Agreement or the return or deletion of Customer Personal Data in accordance with Section 8.1, whichever later.”

• DPA covers CCPA Report an error

  ““CCPA” means the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. and any associated regulations and amendments, including the California Privacy Rights Act amendments.”

• DPA covers EU UK GDPR Report an error

  “(i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (the "EU GDPR"); (ii) the GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 and the UK Data Protection Act 2018 (collectively, the "UK GDPR"); (iii) the EU e-Privacy Directive (Directive 2002/58/EC)”

• DPA security standards reference Report an error

  ““Notion Security Standards” means Notion’s security standards, as updated from time to time, available at: https://notion.notion.site/Security-Exhibit-306efdeead0580b1b316ff746169a11f.”

• DPA restricted transfer scope Report an error

  “(i) where the EU GDPR applies, a transfer of personal data from the EEA to a country outside of the EEA which is not subject to an adequacy determination by the European Commission; and (ii) where the UK GDPR applies, a transfer of personal data from the United Kingdom to any other country which is not subject based on adequacy regulations pursuant to Section 17A of the United Kingdom Data Protection Act 2018”

Scores citing this record

• The Engineering Lead Import, export & self-hosting
• The Engineering Lead European sovereignty
• The IT Administrator European sovereignty
• The Operations Lead Import, export & self-hosting
• The Operations Lead European sovereignty
• The Quality Manager European sovereignty
• The Skeptic European sovereignty
• The Support Knowledge Manager European sovereignty