Is Dropbox GDPR compliant? What universities should check
Dropbox is often already in use at a university before anyone has approved it, because researchers bring personal accounts into projects. This page sets out what Dropbox publicly documents for its team plans, including Dropbox Education, about EU storage, the contract, sharing controls and AI features, and what that means for research data.
Short answer
For customers outside North America, Dropbox team plans are contracted with Dropbox International Unlimited Company in Ireland under the Dropbox Services Agreement, which incorporates a Data Processing Agreement; for European data outside the DPF certification, the DPA relies on processor-to-processor SCCs between Dropbox, Inc. and Dropbox International. Dropbox, Inc. states it complies with the EU-US Data Privacy Framework. Files are stored in the US by default; eligible teams can move file data at rest to EU storage. Dropbox's team plans, including Dropbox Education, carry ISO 27001, 27017, 27018 and 27701 certifications and EU Cloud Code of Conduct adherence. Several AI subprocessors are US-based. The biggest practical issue for universities is usually not the institutional plan but research data sitting in staff members' personal Dropbox accounts.
What Dropbox documents publicly
The table summarises Dropbox's privacy policy, Services Agreement, Data Processing Agreement, subprocessor list, help centre and compliance pages, read on 7 October 2026. It covers team plans (Standard, Advanced, Business, Business Plus, Enterprise and Education). Free, Plus and Professional accounts are individual services with a different legal set-up.
| Topic | What the vendor states | Source |
|---|---|---|
| Company and contracting entity | Documented The Services Agreement (5 December 2024) is with Dropbox International Unlimited Company for customers outside Canada, Mexico and the US. It incorporates the Data Processing Agreement. The privacy policy (30 May 2025) says business agreements may modify it, and notes that a revised policy takes effect on 1 January 2027. | Services Agreement [1], Privacy policy [2] |
| Where data is stored | Plan-dependent Storage servers are in US data centres; servers in Australia, the EU, Japan and the UK are available to eligible teams. Dropbox lists Standard, Advanced, Business, Business Plus or Enterprise, at least 10 licences, annual billing and a billing address that differs from where data is currently stored; requests are reviewed individually. The chosen location applies to file data while stored permanently at rest. | Data storage location [3] |
| Education plan | Documented Dropbox Education is for licensed and accredited higher education institutions purchasing 300 or more licences, with an admin console and 120-day file recovery. | Dropbox Education [4] |
| Data processing agreement | Documented The DPA (version 23 August 2024) makes Dropbox processor, provides that European data processed through a service not covered by Dropbox's DPF certification is processed by Dropbox International and transferred to Dropbox, Inc. under processor-to-processor SCCs between the two, and gives customers 60 days from notice of a new subprocessor to object, with a termination right if no accommodation is found. Stored data is deleted within a commercially reasonable period after an administrator's request made before termination. | DPA (PDF) [5] |
| International transfers (DPF, SCCs) | Documented Dropbox, Inc. states it complies with the EU-US and Swiss-US DPF and the UK Extension; the privacy policy also lists SCCs and adequacy decisions (DPF status read from Dropbox's privacy policy; the official DPF list API returned an error for every query on the check date). | [2], [5] |
| Subprocessors | Documented List updated 29 April 2026: Amazon Web Services for infrastructure, search and LLM processing; OpenAI, Google, Microsoft, Groq and Parallel Web Systems for LLM processing; Oracle, Salesforce, Zendesk, Zoom and Teleperformance (Greece) for billing and support. All except Teleperformance are listed in the US. Customers can subscribe to changes. | Subprocessor list [6] |
| AI features and training | Documented Dropbox says it will not build generative AI models using customer content without consent, and that data sent to OpenAI is not used to train OpenAI models. Whether AI features are on or off by default for Education teams: not found in public documentation (checked 7 October 2026). | AI principles [7], Dropbox AI help [8] |
| Sharing controls | Documented Admins on team plans set the default for who can open shared links (anyone, only people added, or members only), which members can override; they can require passwords and set expiry for new links shared outside the team, and approve outside people or domains for folders. Turning off external link sharing stops existing team links working for people outside the team. | Team sharing settings [9], Link permissions [10] |
| Certifications and codes | Documented For Standard, Advanced, Enterprise and Education: ISO 27001, 27017, 27018, 27701 and 22301, SOC 1, 2 and 3, CSA STAR Level 2, and EU Cloud Code of Conduct adherence with a Level 2 compliance mark. | Certifications [11], GDPR page [12] |
The EU Cloud Code of Conduct adherence is worth noting. The code's public register lists Dropbox at compliance Level 2 (adherence ID 2022LVL02SCOPE3114), with the latest assessment on 17 July 2026 and the next due by 31 December 2026, verified by the code's monitoring body [18]. That gives a university evidence about processor obligations that goes beyond the vendor's own statements.
What this means for a university
Validemic's analysis
Personal accounts are the real exposure. A researcher's free or Professional account sits outside any university contract: Dropbox is then dealing with the individual, not the institution, and none of the team controls apply. If a project's data protection plan says data is stored on university-approved services, research data in personal Dropbox folders breaks that promise, whatever Dropbox's own safeguards. An institutional plan only helps if staff actually move their projects into it.
EU storage needs a deliberate request. Dropbox stores in the US unless an eligible team asks for migration [3]. The help page lists eligible plans without naming Education, while the compliance page lists Education alongside Standard, Advanced and Enterprise [11]. Ask Dropbox to confirm in writing that your Education team can use EU storage, and note that the residency commitment covers file data at rest, not every kind of processing.
Transfers remain part of the picture. Even with EU storage, Dropbox's subprocessors for support, search and AI are mostly US-based [6]. The European Commission adopted its adequacy decision for the EU-US Data Privacy Framework on 10 July 2023 [13]. The DPA's intra-group SCCs apply to European data processed through services not covered by the DPF certification [5]. Document both in your transfer assessment.
Sensitive research data. Special category data under Article 9 GDPR [14], such as health or interview data, calls for links restricted to members or named people, passwords and expiry on anything shared outside the team, and an approval list for partner domains. Dropbox's admin controls support this, but they are settings, not defaults.
AI features. Several LLM providers appear on the subprocessor list [6]. If staff can use AI summaries or search over research folders, decide whether that is acceptable for sensitive projects before it becomes routine.
Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace
Questions to ask Dropbox before approving it for research data
- Is our Dropbox Education (or other team) plan eligible for EU storage, and which data beyond file content at rest stays in the EU?
- Is our contract with Dropbox International Unlimited Company, and does the August 2024 DPA apply unchanged?
- Which AI features are enabled by default for our team, and can administrators switch off third-party AI centrally?
- Which subprocessors would process our content if AI features are used, and in which countries?
- How will the privacy policy change effective 1 January 2027 affect team customers?
- Can we enforce members-only links on selected folders while allowing approved partner domains?
- How do we bring research data from staff members' personal accounts into the institutional team without losing version history?
- Can we obtain the current SOC 2 report, ISO certificates and EU Cloud Code of Conduct verification?
The EU AI Act angle
Dropbox's AI features (summaries, enhanced search, captioning) are general productivity functions, not the education uses listed as high-risk in Annex III of the AI Act [15]. The obligation that applies today is AI literacy: Article 4, as amended by Regulation (EU) 2026/1744, requires deployers to take measures to support the AI literacy of staff using AI systems [16]. High-risk obligations for Annex III systems apply from 2 December 2027 [17].
Sources
- Dropbox Services Agreement (posted 5 December 2024), retrieved 7 October 2026
- Dropbox Privacy Policy (posted 30 May 2025; revised version effective 1 January 2027 announced), retrieved 7 October 2026
- Where does Dropbox store data?, Dropbox Help (updated 31 August 2026), retrieved 7 October 2026
- What is Dropbox Education?, Dropbox Help, retrieved 7 October 2026
- Dropbox Data Processing Agreement with Model Clauses (version 23 August 2024, PDF), retrieved 7 October 2026
- Dropbox Sub-processor List (updated 29 April 2026), retrieved 7 October 2026
- Dropbox AI principles, retrieved 7 October 2026
- How to use Dropbox AI, Dropbox Help, retrieved 7 October 2026
- Manage external sharing in your team, Dropbox Help, retrieved 7 October 2026
- How to set or change shared link permissions, Dropbox Help (updated 20 February 2026), retrieved 7 October 2026
- Dropbox certifications and compliance, retrieved 7 October 2026
- Dropbox and the GDPR, retrieved 7 October 2026
- EU-US data transfers, European Commission, retrieved 7 October 2026
- Regulation (EU) 2016/679 (GDPR), Article 9, text read from the Publications Office copy, retrieved 7 October 2026
- AI Act Annex III, AI Act Service Desk, retrieved 7 October 2026
- AI Act Article 4: AI literacy, AI Act Service Desk (as amended by Regulation (EU) 2026/1744), retrieved 7 October 2026
- AI Act Article 113: Entry into force and application, AI Act Service Desk, retrieved 7 October 2026
- EU Cloud Code of Conduct public register: list of adherent services, retrieved 7 October 2026
About this page
We read Dropbox's Services Agreement, privacy policy, Data Processing Agreement, subprocessor list, help centre articles on storage location, Education, sharing and AI, its AI principles, GDPR and certifications pages, and the relevant EU legal texts on 7 October 2026. Statements about Dropbox come from those pages; our own interpretation is labelled as Validemic's analysis. This page is not legal advice and does not say whether any particular use of Dropbox complies with the GDPR. If you spot an error or Dropbox has updated a document, please contact us and we will correct it.
Frequently asked questions
Is Dropbox GDPR compliant?
No tool is GDPR compliant on its own. For team plans, Dropbox's Services Agreement incorporates a Data Processing Agreement that relies on processor-to-processor SCCs between Dropbox entities for European data outside the DPF certification, Dropbox, Inc. states that it complies with the EU-US Data Privacy Framework, and its Standard, Advanced, Enterprise and Education team plans are declared adherent to the EU Cloud Code of Conduct. Whether a university's use complies depends on the plan, storage location, sharing settings and the data stored.
Does Dropbox store data in the EU?
Dropbox's default storage is in the United States. Eligible teams can have file data stored in the EU, UK, Australia or Japan. Dropbox lists Standard, Advanced, Business, Business Plus and Enterprise plans, at least 10 licences, annual billing and a billing address that differs from the current storage location, and says the location applies to file data while stored permanently at rest. Migration is requested through support.
Is there a Dropbox plan for universities?
Yes. Dropbox Education is offered to licensed and accredited higher education institutions buying 300 or more licences. Dropbox lists the Education plan under its ISO certifications, SOC reports and EU Cloud Code of Conduct adherence. The help page on EU storage eligibility did not name the Education plan on the check date, so ask Dropbox to confirm.
Does Dropbox use files to train AI?
Dropbox's AI principles say it will not build generative AI models using customer content without consent, and its help pages say data sent to OpenAI is not used to train OpenAI models. Its subprocessor list names OpenAI, Google, Amazon Web Services, Microsoft, Groq and Parallel Web Systems, all in the US, for large language model processing.
Can a university stop Dropbox links from being public?
On team plans, administrators can set the default for who can open shared links (anyone, only people added, or team members only), which members can override, require passwords on new links shared outside the team, set link expiry and approve which outside people or domains can be added to folders. Turning external link sharing off makes existing links created by team members stop working for people outside the team.