GDPR Compliance for Low-Code and No-Code Platforms

Low-code and no-code platforms (Bubble, Airtable, Zapier, Make, Webflow, Notion, Softr, Glide, FlutterFlow) have democratised software development — but they also create GDPR compliance blind spots. If you build for EU users using these tools, understanding your data controller obligations is essential.

Who Is the Data Controller?

You are. The low-code platform provides infrastructure and tools, but you determine what data to collect, how to use it, and who to share it with. This makes you the data controller under Article 4(7). The platform is a data processor (Article 4(8)). This means Article 27’s EU Representative requirement applies to you, not the platform.

Platform-Specific Considerations

Bubble: Bubble hosts your application’s data on its EU or US servers. You control the data model. If you use EU Bubble hosting, the data stays in the EU region, but you still need an EU Representative (Article 27) and a DPA with Bubble.

Zapier / Make (Integromat): Automation tools process your data through third-party integrations. Every “Zap” that touches EU personal data creates data processing activities you must document in your ROPA.

Airtable / Notion: Databases and collaboration tools storing EU user/client data. Both offer GDPR-compliant configurations (data processing agreements, EU hosting), but you remain the controller. Notion/Webflow guide →

Webflow: Websites built on Webflow use Webflow’s hosting and CMS. Webflow provides DPAs and EU hosting options. You need to add cookie consent, Privacy Policy, and EU Representative. Webflow guide →

Glide / Softr / FlutterFlow: App builders — your app collects EU user data. You control the data model, authentication, and third-party integrations. Full GDPR compliance is your responsibility.

Common Low-Code GDPR Gaps

• No Privacy Policy: Most low-code builders start as MVPs without one
• No cookie consent: Default tracking cookies go unnoticed
• No ROPA: Processing activities across multiple low-code tools are undocumented
• No EU Representative: Article 27 compliance is completely overlooked

Quick Compliance Checklist

1. Appoint an EU Representative (EUR 490/year)
2. Request DPAs from each low-code platform you use
3. Map your data flows across all connected tools
4. Create a ROPA covering all platforms
5. Add cookie consent to any public-facing app

Get started →