Directory › Workflow automation › Zapier (incl. Zapier Agents)
Is Zapier (incl. Zapier Agents) UK GDPR compliant?
In plain English
Zapier, including Zapier Agents, stores all data in AWS in the United States and says plainly that EU-only storage is not supported. Its DPA does include the UK Addendum and it is certified under the UK Extension to the EU-US Data Privacy Framework. Only Enterprise accounts are opted out of model training automatically; other plans must opt out.
The facts, with sources
| Field | What the vendor publishes | Source |
|---|---|---|
| UK/EU data residency | No UK/EU region Zapier hosts data in AWS in the United States. Asked whether data can be stored only in the EU: 'Zapier does not support this option.' | zapier.com/legal/data-privacy |
| DPA and UK GDPR transfer terms | Yes, UK Addendum/IDTA DPA defines and applies the ICO UK Addendum to restricted transfers subject to UK GDPR (sections 1.16 and 10.2.2.4). Zapier will not sign customers' own DPAs. | zapier.com/legal/data-processing-addendum |
| SOC 2 | Yes SOC 2 Type 2 and SOC 3. | zapier.com/legal/data-privacy |
| ISO 27001 | Not published Zapier cites ISO 27001 only for its hosting providers, not for itself. | zapier.com/legal/data-processing-addendum |
| Self-hostable | Not published No self-hosted edition is documented; data is hosted by Zapier in AWS US. | zapier.com/legal/data-privacy |
| Sub-processor list | Public Public list (posted 9 Oct 2026, effective 23 Oct 2026), nearly all US-located. View list | zapier.com/legal/subprocessors |
| AI model providers | AWS, Anthropic, Baseten, Fireworks AI, Google, Meta, Microsoft, OpenAI Listed as AI sub-processors; Zapier says they may not use customer content to train their models. Bring Your Own Model via AWS Bedrock is offered. | zapier.com/legal/subprocessors |
| Customer data used for training? | Partly / conditional Enterprise customers are automatically opted out of Zapier using their content for model training; all other customers can opt out. | zapier.com/legal/automation-platform-information |
Questions UK buyers ask
Is Zapier (incl. Zapier Agents) UK GDPR compliant?
No tool is UK GDPR compliant on its own. It depends on how you use it. On the vendor's side, Zapier (incl. Zapier Agents) does not offer UK or EU data residency on its hosted service; its DPA status is "Yes, UK Addendum/IDTA"; SOC 2: Yes; ISO 27001: Not published. AgentSafe UK readiness score: 47/100 (Mixed).
Does Zapier (incl. Zapier Agents) store data in the UK?
Zapier hosts data in AWS in the United States. Asked whether data can be stored only in the EU: 'Zapier does not support this option.'
Does Zapier (incl. Zapier Agents) use my data to train AI models?
Enterprise customers are automatically opted out of Zapier using their content for model training; all other customers can opt out.
Not legal advice. AgentSafe UK summarises what vendors publish about themselves. It is not legal advice and is not a statement that any tool is "compliant": UK GDPR compliance depends on how you use a tool. Always check the linked sources and take professional advice for your situation.