Is it GDPR compliant? Vendor checks for universities
Fact sheets on the tools researchers and teachers ask their DPO about. Each one sets out what the vendor publicly documents about hosting, data processing agreements, subprocessors, international transfers and AI training, with every source linked and dated.
AI research assistants
ConsensusUS AI search engine for research papers: hosting, AI model providers, training, transfers and DPA.ElicitUS AI research assistant: DPA, subprocessors, SOC 2, training by plan and transfers.Google NotebookLMGoogle's AI notebook (now Gemini Notebook): personal vs Workspace for Education terms, training, regions.PerplexityUS AI answer engine: consumer vs Enterprise training defaults, DPA, DPF, subprocessors, Education Pro.ResearchRabbitCitation-mapping tool run from New Zealand: US hosting, SCCs, OpenAI and Databricks named, no-training pledge.SciSpaceUS AI research platform (formerly Typeset): hosting, DPA on request, SOC 2, training and transfers.sciteUS citation and AI research assistant: US processing, SCCs, no-training terms, advertising cookies.
General AI assistants
ChatGPTOpenAI's assistant: individual plans versus Business, Enterprise and Edu, EU residency, training.Google GeminiPersonal Gemini app versus Gemini for Workspace and Education: DPA, data regions, training.Microsoft CopilotMicrosoft 365 Copilot and Copilot Chat: DPA, EU Data Boundary, web search and Anthropic exceptions, training.
AI writing tools
DeepL Translator and WriteGerman translation service: free versus Pro data handling, DPA, AWS infrastructure change and SSO.GrammarlyWriting assistant now part of Superhuman: US hosting, DPA, training defaults per plan, DPF and subprocessors.Jenni AIUS AI academic writing assistant: hosting, training, deletion periods, analytics and missing DPA.PaperpalCactus Communications' academic writing tool: no-training pledge, hosting in Asia and the US, transfers, DPA.
Transcription
Otter.aiUS meeting transcription: US hosting, built-in DPA, DPF, training on de-identified data, Enterprise controls.RevUS AI and human transcription: public DPA with SCCs, US hosting, ASR training terms and human transcribers.TrintUK transcription service: EU and US tenants, no-training clause, ISO 27001, voiceprint data and DPA terms.
Survey platforms
Google FormsConsumer accounts versus Workspace for Education: DPA, data regions, Gemini, transfers and admin controls.QualtricsSurvey platform: DPA with SCCs, customer-selected data centre region, ISO certifications, admin-controlled AI.SurveyMonkeySurvey platform: Irish contracting entity, DPA with SCCs, EU data centre on Enterprise, AI and anonymity.
Qualitative analysis
ATLAS.tiBerlin-based qualitative analysis tool: EU-hosted web app, public DPA, AI coding via OpenAI and Deepgram in the US.NVivoQualitative analysis by Lumivero: desktop vs AI Cloud, OpenAI-based AI features, public DPA, EU hosting option.
Teaching, meetings and collaboration
Instructure Canvas LMSUS learning platform: EU hosting in practice, DPF, IgniteAI controls and the 2026 security incident.MentimeterSwedish polling tool: EU hosting by default, controller position on DPAs, subprocessors and AI terms.Microsoft Teams (Education)Microsoft 365 Education: EU Data Boundary, DPA, recordings and transcripts, Copilot in Teams and SURF DPIAs.MiroOnline whiteboard: EU data residency on all plans, DPA, AI training terms by plan and US subprocessors.PadletCollaborative boards: US hosting on Google Cloud, DPA for Schools plans, DPF, AI features and public profiles.ProctorioOnline exam proctoring: regional storage, encryption, face and gaze detection, and AI Act high-risk duties.TurnitinSimilarity checking and AI writing detection: EU storage, DPA, repository choices and the AI Act.Zoom WorkplaceUS video platform: EU data centres on paid plans, DPA, AI Companion subprocessors and transfers.
These pages describe public documentation, not a legal opinion. No tool is GDPR compliant on its own: compliance depends on your contract, configuration and use case. Vendors who spot an error can contact us and we will correct it.