"Is n8n GDPR compliant?" I hear this question often, and it is the wrong question. The GDPR does not apply to a piece of software, it applies to what you do with personal data. The same n8n can run a spotless process or a problematic one, depending on what you plug into it.
This article goes through the practical questions I ask myself when I build an automation that touches client, employee or prospect data. It is written from a European point of view: the GDPR applies to EU businesses and to anyone processing data of people in the EU. If you have not picked your tool yet, start with my n8n vs Make vs Zapier comparison, which also covers self-hosting.
Does this article replace legal advice?
No. I am a developer, not a lawyer. I give you a practical method and the official pages where the rules are explained, mostly from the CNIL, the French data protection authority. For sensitive processing (health, children's data, employee monitoring, large volumes), have your analysis checked by a legal professional or your data protection officer.
Who is responsible for data in an n8n automation?
Usually, you are: the business that decides why and how data is processed is the controller. Providers that process data on your behalf are processors under Article 28 of the GDPR: your server host, n8n if you use its cloud, the AI model provider, the email or text service. Each one must be bound by an agreement that states what it may do with the data.
A good point for n8n: its legal page offers a pre-signed data processing agreement (DPA) to download, countersign and return. Do the same with every service plugged into your workflows.
Do you need to self-host n8n to comply with the GDPR?
Not necessarily. Both options can work, with different responsibilities.
| Point | n8n Cloud | Self-hosted n8n |
|---|---|---|
| Data location | In the EU, servers in Frankfurt (n8n pricing page) | Wherever you rent the server: pick the EU |
| Processing agreement | DPA offered by n8n | With your hosting provider |
| Security, backups, updates | Handled by n8n | On you |
| Data sent to the vendor | The vendor hosts everything | Anonymous telemetry by default, can be turned off |
| Execution history | Kept 7 days (Starter) or 30 days (Pro) per the pricing page | Set with environment variables |
When self-hosted, n8n's docs state that the tool sends anonymous telemetry by default. You turn it off with N8N_DIAGNOSTICS_ENABLED=false, and version checks with N8N_VERSION_NOTIFICATIONS_ENABLED=false. Self-hosting gives you the most control, provided you know how to secure a server. A poorly maintained server is a bigger risk than a well-run European cloud.
Where does data really go in a workflow?
This is the point most people miss. n8n is a pipe: every node sends or receives data from another service. Hosting n8n in the EU changes nothing if the workflow sends the content of your emails to a service outside the EU.
Take a typical workflow: a quote request form on your site, an AI step that summarizes the request, a row in a spreadsheet, a confirmation email to the client. The data passes through:
- your website form (and its host);
- n8n (and its host);
- the AI model provider;
- the spreadsheet vendor (Google, Microsoft…);
- your mailbox.
Five services, so potentially five agreements to check and five storage locations. If one of them processes data outside the European Union, the transfer must be covered by safeguards: the CNIL explains this on its page about transfers outside the EU.
Execution history, the copy people forget
By default, n8n keeps a record of each execution, with the data that went through every node. It is very useful for fixing errors, but it is also a copy of personal data. When self-hosted, the docs state that automatic pruning is on by default: executions older than 14 days (336 hours) are deleted, or the oldest ones past 10,000. You can go further and keep only failed executions. Data should not be kept longer than necessary: set this period accordingly.
What does the CNIL say about AI agents and generative AI?
In its Q&A on using a generative AI system (published July 18, 2024), the CNIL gives several useful pointers for an AI agent running in n8n:
- start from a specific need rather than deploying the tool with no purpose;
- for personal or strategic data, an on-premises deployment generally seems more appropriate and secure to the CNIL; a cloud API remains possible, provided the external infrastructure is secured;
- an agreement with the provider that sets out responsibilities and authorized access to the data;
- avoid sending personal data when it is not needed;
- do not reuse outputs as they are, and train users.
In July 2026, the CNIL also published, with France's AI and digital council, an exploratory note on agentic AI and personal data. If your agents make decisions or act on their own (sending an email, editing a record), read it.
In practice, I build AI agents so a human approves sensitive cases, and I pick AI providers that do not use my clients' data to train their models. That is how I work on my custom AI agent projects.
Which GDPR checklist should you apply to an n8n workflow?
For every workflow that touches personal data, I go through these questions. They do not replace a legal analysis, but they prevent the most common oversights.
| Question | Where to look | Example (quote request) |
|---|---|---|
| What data goes through? | Every node in the workflow | Name, email, phone, description of the need |
| Is all of it needed? | The form fields | Date of birth serves no purpose: remove it |
| Where is it stored? | Host of n8n and of each service | EU server, spreadsheet, mailbox |
| Is there an agreement with each provider? | Legal pages (DPA) | Host, AI provider, email service |
| How long is it kept? | Execution settings, spreadsheet | Short n8n history, spreadsheet cleaned regularly |
| Who has access? | n8n accounts and credentials | Two named accounts, two-factor authentication |
| Is it in your records of processing? | Records of processing activities | Entry "handling quote requests" |
On records of processing: the CNIL states that the obligation applies to every organization, whatever its size. Organizations with fewer than 250 employees get an exemption, but it is narrow: regular processing, risky processing and processing of sensitive data must still be recorded. An automation that runs every day is, by nature, regular processing. The CNIL offers a simplified template for small organizations.
When should you get help?
- Health data, sensitive data or children's data. A data protection impact assessment (DPIA) may be mandatory: the CNIL explains when.
- Monitoring or assessing people (employees, candidates), or automated decisions about them.
- Large volumes or combining several data sets.
- Nobody in the company can keep a server up to date. In that case, prefer a European cloud service to an abandoned self-hosted n8n.
Otherwise, a well-designed automation often respects the GDPR better than a manual process: fewer copies in mailboxes, fewer stray files, retention periods applied automatically. When I build an automation for a business, I deliver the list of services used and the data that goes through them, so you can complete your records.
Sources checked on October 17, 2026
- CNIL, Q&A on using a generative AI system (in French)
- CNIL, agentic AI and personal data: exploratory note (in French)
- CNIL, records of processing activities (in French)
- CNIL, data retention periods (in French)
- CNIL, transferring data outside the EU (in French)
- CNIL, data protection impact assessment (in French)
- CNIL, personal data security guide (in French)
- General Data Protection Regulation (EUR-Lex)
- n8n pricing page (cloud data location) and data processing agreement
- n8n, control telemetry and manage execution data
Frequently asked questions
Is n8n GDPR compliant?
No software is compliant on its own: what matters is how you use it. n8n makes compliance possible, self-hosted on an EU server or on n8n Cloud, hosted in Frankfurt, with a data processing agreement offered by the vendor. You also need to check every service plugged into your workflows.
Where is n8n Cloud data hosted?
According to n8n's pricing page, checked on October 17, 2026, data for hosted plans is stored in the European Union, on servers located in Frankfurt, Germany.
Do you have to host n8n in your own country?
The GDPR has no general rule requiring that. It looks at the European Union as a whole and at transfers outside it. A server in the EU makes things simpler. What matters most is where the services in your workflows process the data.
Can you use an AI agent with client data?
Yes, with precautions. The CNIL recommends starting from a specific need, binding the provider with an agreement, avoiding unnecessary personal data and not reusing outputs as they are. For sensitive data, it considers an on-premises deployment generally safer.
How long does n8n keep execution history?
When self-hosted, the docs state that automatic pruning is on by default: executions older than 14 days are deleted, or the oldest ones past 10,000. Both values can be changed with environment variables.