Our flows handle customer data, how do I stay GDPR-compliant?

Automation processes PII automatically, exactly where GDPR applies. Three pillars: purpose limitation, data minimisation, transparency to the data subject. Plus a DPA with your iPaaS vendor.

Try this first

1. 1Inventory which flows touch PII: name, mail, phone, social security number, IP, payment data. Add them to your processing register with legal basis.
2. 2Per flow: pass only fields the purpose justifies. A 'lead-to-CRM' doesn't need birth date, a payroll flow does.
3. 3Sign a DPA with your iPaaS tool. Zapier, Make, n8n.cloud, Microsoft have standard DPAs. Keep the signed copy.
4. 4Check where the data is stored: EU region (n8n.cloud EU, Make EU), US (Zapier partly), or self-hosted in your own data center. For sensitive ids or medical data prefer EU or self-host.
5. 5Document retention: how long does data stay in iPaaS history? Set it short (7-30 days) when the data lands in your target system anyway.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.