GDPR check

Is NVivo GDPR compliant? What universities should check

NVivo is the qualitative analysis tool many universities already license, so most DPO questions are not about whether to use it but about which parts. Interview transcripts in a local NVivo project, the same transcripts in NVivo AI Cloud, and a passage sent to the AI Assistant are three different processing situations. This page sets out what Lumivero publicly documents about each.

Published 7 October 2026 · Sources checked 7 October 2026

Short answer

NVivo is made by Lumivero, LLC, based in Denver, Colorado. NVivo Desktop keeps projects on the researcher's computer, while optional cloud features and the newer NVivo AI Cloud process data on Lumivero's infrastructure (Microsoft Azure, with a Europe region among five). AI features send selected content to third-party providers; NVivo's help centre names OpenAI, under a zero-retention, no-training agreement. Lumivero publishes a DPA with the Standard Contractual Clauses and a subprocessor list, and offers a SOC 2 Type II report on request. The main decisions for a university are which NVivo product and which AI features may be used with participant data.

Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers qualitative analysis of interviews with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data

What Lumivero documents publicly

All sources were read on 7 October 2026. "Not found publicly" means we did not find it in the sources listed at the end of this page; it does not mean the safeguard does not exist.

Topic	What the vendor states	Source
Company and establishment	Documented Lumivero, LLC, main office in Denver, Colorado, with group companies in the UK, Australia, Japan, France and Switzerland. A Data Protection Officer can be contacted by email. Not found publicly An EU representative under Article 27 GDPR.	[1]
Products and where data sits	Product-dependent NVivo Desktop is a "locally installed" application for Windows and Mac; teams can collaborate through NVivo Collaboration Cloud or Collaboration Server. NVivo AI Cloud is a separate browser-based product running on Microsoft Azure, "with data hosted in five regions: Europe, the United States, Canada, Singapore, and Australia".	[2] [3] [4]
Data processing agreement	Documented Data Protection Addendum, last updated 16 June 2025, part of the Master License and Software Agreement and applying to cloud services. Lumivero is processor; deletion or return within 30 days of the end of services; breach notice "without undue delay"; assistance with DPIAs; audit rights. Schedule 1 names "research participants" and special category data, including health, among the data that may be processed.	[5]
Subprocessors	Documented Listed in the DPA: Anthropic, Auth0, AWS, Cloudflare, Cryptlex, EA Send Mail, Google Analytics, Hotjar, LogRocket, Mailchimp, Marketo, Microsoft Azure, Netsuite, OpenAI, Pardot, QWeb, Salesforce, SendGrid, Sentry.io, Speechmatics, Zendesk and Zuora. The list does not say which product or function each supports, or where each is located.	[5]
International transfers	Documented The DPA incorporates Modules One and Two of the Standard Contractual Clauses (governed by Irish law) and the UK Addendum. Not found publicly Data Privacy Framework certification: no entry for Lumivero on the official list, active or inactive.	[5] [6]
AI features and providers	Documented, opt-in use NVivo 15's AI Assistant summarises text and documents, suggests child codes, summarises coded content and searches papers; from version 15.4, sentiment autocoding also uses generative AI. Lumivero has an Enterprise Agreement with OpenAI under which uploaded data is not used for training and is deleted once the operation completes. Users accept AI Terms of Use before first use. NVivo AI Cloud's assistant, AURA, is built into the product; its model provider is not named on the product page.	[3] [7] [8]
AI model training	Documented "Neither Lumivero nor any third-party service provider shall use Customer Data or inputs to train an A.I. model." The same terms allow inputs and outputs to be examined in case of suspected abuse. NVivo AI Cloud states zero data retention for AI processing after each task.	[3] [9]
Security certifications	Documented The trust centre offers a SOC 2 Type II report (under NDA) and a public scoping letter, a CAIQ for NVivo AI Cloud, a HECVAT and CAIQ for NVivo Cloud, and TX-RAMP certification for NVivo Collaboration Cloud. Not found publicly An ISO 27001 certificate.	[10]
Institution controls	Product-dependent On Windows, administrators can disable NVivo's AI features through a registry value. NVivo AI Cloud is currently sold as individual subscriptions; team and organisation access is announced for early 2027.	[3] [4]

Lumivero deserves credit for a public DPA that explicitly anticipates research participant and special category data, a named subprocessor list, a contractual no-training clause that also binds its AI providers, an administrator switch for AI features in the desktop product, a European hosting region for the cloud product, and higher-education questionnaires (HECVAT, CAIQ) available in its trust centre.

What this means for research with participants

Validemic's analysis

Interview transcripts are often special category data. Qualitative projects routinely hold what participants say about health, religion, politics, sexuality or ethnicity, which are special categories under Article 9(1) GDPR [11]. Universities usually process this under Article 9(2)(j) for scientific research, with safeguards under Article 89, such as pseudonymisation and data minimisation [11]. Research ethics approvals and participant information sheets typically describe where the data will be stored and who can access it. Each NVivo choice below changes that answer.

Desktop, collaboration and AI Cloud are different processing. A local NVivo Desktop project stays on the university-managed device or network drive; on our reading of the documentation, project content reaches Lumivero only when a cloud or AI feature is used (licence activation and account data are a separate, smaller flow). Collaboration Cloud, transcription and NVivo AI Cloud move content to Lumivero's infrastructure, which is where the DPA, the subprocessor list and the hosting region matter. For NVivo AI Cloud, ask Lumivero to confirm in writing that your accounts are hosted in the Europe region and whether AI processing also stays there.

AI features send excerpts to a third party. When a researcher summarises a transcript or asks for suggested codes, the selected content goes to an external model provider. The zero-retention and no-training commitments are strong safeguards, but this is still a disclosure to a subprocessor, and the help centre does not say where the AI processing takes place. Check whether your ethics approval and information sheet cover it. Many institutions will want transcripts pseudonymised before any AI feature is used, and some will disable AI features centrally until a policy is in place, which the registry setting allows.

Contract route matters. The DPA is part of the Master License and Software Agreement. A university site licence can bring it into force for all staff. Students or researchers buying individual NVivo AI Cloud subscriptions are less likely to have it in place, because organisational access is only announced for 2027. Until then, an individual subscription is a poor fit for participant data.

Points to tidy up. The Global Privacy Policy is dated 3 April 2023 and does not mention the GDPR by name, NVivo AI Cloud or the AI features; it covers Lumivero's own controller processing, while the DPA governs research data. The subprocessor list is not split by product, so ask which entries apply to NVivo.

DPIA likelihood. Processing special category data about participants with new AI features is likely to meet the criteria for a DPIA under Article 35 GDPR [11], especially in health research or with vulnerable groups. Use our DPIA screening tool for a first view, and reuse the assessment across projects that share the same NVivo set-up.

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

Questions to ask Lumivero before approving NVivo features

Is the Data Protection Addendum in force under our site licence, and does it cover Collaboration Cloud, transcription and NVivo AI Cloud?
Which of the listed subprocessors process NVivo project content, and in which countries?
Can NVivo AI Cloud accounts for our institution be fixed to the Europe region, and where does AI processing for AURA take place?
Which model providers does AURA use, and do the same zero-retention and no-training terms apply as for the desktop AI Assistant?
Under section 1.6 of the AI Terms of Use, who may examine inputs and outputs in a suspected abuse case, and where?
Can AI features be disabled centrally on macOS and in NVivo AI Cloud, as they can on Windows?
When will organisational licences for NVivo AI Cloud, with admin controls and single sign-on, be available?
Can we see the SOC 2 Type II report, and does its scope include NVivo AI Cloud and the AI pipeline?
Will you update the 2023 Global Privacy Policy to cover NVivo AI Cloud and the AI features?

An EU-built option

Looking for a European tool for qualitative analysis of interviews?

Kahubi is an AI research workspace built by Avidemic AB, a company registered in Sweden. Researchers use it to transcribe interviews, code them and run a thematic analysis, then write up the findings.

Runs on servers in the European Union, under EU law end to end
Your papers, data and recordings are never used to train AI models
For institutional customers, every subprocessor is a European company processing data in the EU
Interview recordings are transcribed by European providers (Gladia in France, Lemonfox in Germany)

Explore Kahubi See Kahubi's subprocessors

Disclosure: Kahubi and Validemic are both built by Avidemic AB. Assess any tool, ours included, against your own institution's requirements.

The EU AI Act angle

Coding, summarising and querying research interviews is not one of the high-risk education uses listed in Annex III, point 3 of the AI Act, Regulation (EU) 2024/1689 [12]. Those cover AI used for admission, evaluating learning outcomes, assessing the level of education a person will receive, or monitoring students during tests. Lumivero's AI Terms of Use also prohibit using its AI services for automated decisions with legal or similarly significant effects [9].

NVivo's sentiment autocoding classifies text as positive or negative. Text-based sentiment analysis is not the same as emotion recognition, which the Act defines in relation to biometric data (Article 3(39)), and Article 5(1)(f) prohibits inferring emotions of people in workplaces and education institutions [12]. Researchers analysing audio or video of students or staff should keep that boundary in mind.

A university that uses an AI system under its authority is a deployer (Article 3(4)). Article 4 on AI literacy has applied since 2 February 2025; Regulation (EU) 2026/1744 (the Digital Omnibus on AI), in force since 27 July 2026, amended it so that deployers must take measures to support the AI literacy of their staff [13]. For qualitative researchers, that includes understanding how AI-suggested codes are produced and recording their use in the methods section. The same regulation moved the Annex III application date to 2 December 2027 [13].

Sources

Lumivero, Global Privacy Policy (last updated 3 April 2023), retrieved 7 October 2026
Lumivero, NVivo Desktop, retrieved 7 October 2026
NVivo 15 (Windows) Help, "AI Assistant", retrieved 7 October 2026
Lumivero, NVivo AI Cloud (including FAQ), retrieved 7 October 2026
Lumivero, Data Protection Addendum (last updated 16 June 2025), retrieved 7 October 2026
Data Privacy Framework List (searched for "Lumivero" and "QSR", active and inactive participants), retrieved 7 October 2026
NVivo 15 (Windows) Help, "Automatically detect and code sentiment", retrieved 7 October 2026
Lumivero, Official Information About Lumivero (last updated October 2026), retrieved 7 October 2026
Lumivero, Artificial Intelligence Terms of Use, retrieved 7 October 2026
Lumivero Trust and Compliance Center, retrieved 7 October 2026
Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 9, 27, 28, 35 and 89, retrieved 7 October 2026
Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 3, 4, 5(1)(f) and Annex III, Official Journal text read via the Publications Office, retrieved 7 October 2026
Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text read via the Publications Office, retrieved 7 October 2026

About this page

We read Lumivero's Global Privacy Policy, Data Protection Addendum, AI Terms of Use, trust centre listing, NVivo product pages and NVivo help centre, and searched the official Data Privacy Framework list, all on 7 October 2026. We did not download the documents in the trust centre, so their contents are not reflected here. "Not found" means we could not find the information in public documentation; it does not mean Lumivero lacks it. Products, terms and features change, so confirm the current position with Lumivero before relying on it.

This page describes public documentation and gives our own analysis. It is not legal advice and it is not a statement that the tool is or is not GDPR compliant, which depends on your contract, configuration and use. If you work at Lumivero and see an error, please contact us and we will correct it.

Frequently asked questions

Does NVivo send my interview data to OpenAI?

Only when AI features are used. NVivo's help centre says Lumivero has an Enterprise Agreement with OpenAI under which data uploaded from NVivo is not used for training and is deleted from OpenAI's servers once the operation completes. Coding, querying and storing a local NVivo Desktop project do not require the AI Assistant, and administrators can disable the AI features with a registry setting on Windows.

Where is NVivo AI Cloud data stored?

Lumivero says NVivo AI Cloud runs on Microsoft Azure with data hosted in five regions: Europe, the United States, Canada, Singapore and Australia. Which region a given account uses, and whether AI processing stays in the same region, should be confirmed with Lumivero.

Does Lumivero sign a GDPR data processing agreement?

Yes. Lumivero publishes a Data Protection Addendum (last updated 16 June 2025) for its cloud services. It makes Lumivero the processor, incorporates the EU Standard Contractual Clauses and the UK Addendum, lists subprocessors, and names research participants and special category data in its description of processing.

Is NVivo data used to train AI models?

Lumivero's AI Terms of Use say that neither Lumivero nor any third-party service provider will use customer data or inputs to train an AI model. The NVivo AI Cloud page also states zero data retention for AI processing after each task.

Is Lumivero certified under the EU-U.S. Data Privacy Framework?

On 7 October 2026 a search of the official Data Privacy Framework list returned no active or inactive entry for Lumivero. Its DPA relies on the Standard Contractual Clauses for transfers.