Is Overleaf GDPR compliant? What universities should check
Overleaf is the default LaTeX editor for many research groups and is licensed campus-wide by a growing number of universities. This page sets out what Overleaf and its parent company Digital Science publicly document about hosting, contracts, transfers, AI features and institutional licences, and what that means for a university.
Short answer
Overleaf is operated by Digital Science UK Limited in London, part of the Digital Science group, with an EU representative in Stuttgart. Its main storage is Google Cloud Platform, and all the processors it lists, including OpenAI and Anthropic for AI features, are given a US location. Its US affiliate is an active Data Privacy Framework participant, and Digital Science holds an ISO 27001 certificate that covers Overleaf. AI features need the user's consent before content goes to third parties and can be switched off by group or Commons administrators. The main questions for a university are the contract behind its licence, where data is stored and how AI is configured.
Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers AI writing support with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data
What Overleaf documents publicly
Everything in this table comes from Overleaf's and Digital Science's own pages or the official Data Privacy Framework list, read on 7 October 2026. Numbers in brackets refer to the sources at the end of the page.
| Topic | What the vendor states | Source |
|---|---|---|
| Company and establishment | Digital Science UK Limited (formerly Writelatex Ltd), registered in England and Wales, operates Overleaf. For some customers, for example with a billing address in the US, Canada or South Africa, the service is provided through its US affiliate Digital Science & Research Solutions Inc. The EU representative is DS Digital Science GmbH in Stuttgart, Germany. Privacy Notice last modified 11 June 2026; Terms 5 May 2026. | [1] |
| Where data is stored | US-listed processors Overleaf "uses Google Cloud Platform for data storage", with redundant backups in multiple locations. The processor list gives a US location for every hosting provider (Google Cloud, AWS, Heroku, MongoDB Atlas). An EU region for the cloud service was not found in public documentation (checked 7 October 2026). On-premises versions (Server Pro and Community Edition) exist. | [1] [2] [3] |
| Data processing agreement | Documented The processor list says that where Overleaf processes an institution's personal data as its processor, the listed entities are subprocessors, and organisations without a DPA can execute one through a linked e-signature form. Managed subscriptions are set up under a separate contract with the paying organisation. | [1] [2] |
| Subprocessors | Documented Public list (May 2026) of 20 providers, all with a US location, including Anthropic and OpenAI ("data processing"), Algolia, Google Cloud, AWS, Heroku, MongoDB Atlas, Redis, Sentry, SendGrid, Stripe and SheerID. Group companies in the UK, Romania, Germany, the US and the Netherlands (Writefull BV) may also be involved. Customers can subscribe to email notice of changes to the list. | [1] [2] |
| International transfers | Documented The privacy notice says transfers from the UK or EEA use adequacy, model contracts or another recognised standard. Digital Science & Research Solutions Inc. was an active participant in the EU-US DPF and UK Extension (non-HR data) on the official list. The EU recognises the UK as adequate. | [1] [4] [5] |
| AI features and training | Configurable AI features (AI assistant, Error Assist, Writefull language suggestions, rewrite and generate tools, TeXGPT) come with a daily allowance that depends on the plan. The documentation says they are available to all users unless an organisation has turned them off, and users can disable them in account settings. Some send content to third parties including OpenAI, after the user accepts AI terms. The terms say inputs and outputs are not used to train models without consent, and LLM provider contracts prohibit training. | [1] [6] [7] |
| Retention and deletion | Users can close unmanaged accounts themselves; backed-up versions "might persist". For managed accounts the organisation can close accounts and access, delete or reassign projects. Pro groups with managed users are deleted after a set period once the subscription ends. | [1] [8] |
| Security certifications | Documented Digital Science's ISO/IEC 27001:2022 certificate (number 21331, valid to 3 January 2029) lists Overleaf in scope. Its ISO/IEC 27701 certificate covers group operations and Dimensions, not Overleaf. Files travel over TLS. | [1] [9] |
| Institution controls | Plan-dependent Overleaf Commons gives campus-wide access with SSO or domain-based enrolment, an admin hub and usage metrics. Group Pro adds group SSO and managed users. Group admins can set AI unavailable; Commons institutions can ask support to disable AI. | [6] [10] [11] |
Overleaf deserves credit for several things a DPO looks for: a public processor list with a subscription for change notices, a DPA that organisations can sign online, a written no-training commitment that extends to its LLM providers, an ISO 27001 certificate with a published scope, a named EU representative, an on-premises option, and an institution-wide switch to disable AI.
What this means for a university
Validemic's analysisWhat goes into Overleaf. Most projects are manuscripts, theses and slides. They contain authors' names and emails, unpublished findings and sometimes data tables. Research that quotes participants or includes clinical results can bring special category data under Article 9 GDPR [12] into a project, often without anyone noticing.
Account type is the main control. The terms set out three different positions: an individual unmanaged account, an account upgraded through an institutional licence, and a managed account controlled by the organisation. Only the latter gives the university control over content when a person leaves. The privacy notice also says that registering with an organisational email can let representatives of that organisation see the user's email address and usage statistics [1], which belongs in staff information.
Transfers. The contracting company sits in the UK, which the EU treats as adequate, but the processor list places hosting and AI providers in the US. A university should establish which transfer mechanism covers each step from its contract partner onwards. The DPF certification of the US affiliate helps where that affiliate is involved, but it does not by itself cover the other US processors. Our transfer mechanism tool can help structure this.
AI is a configuration decision. When a user accepts the AI terms, project text, error logs and file names can go to OpenAI or other providers, and the AI assistant may query third-party search engines [6]. For unpublished research or theses under embargo, many universities will want AI off by default and switched on only where a department has assessed it. The institution-wide switch makes that practical.
On-premises. For groups handling sensitive data, Overleaf Server Pro can run on infrastructure the university controls [3]. That moves hosting questions in-house but adds operating work.
Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace
Questions to ask Overleaf before approving it
- Which Digital Science entity signs our licence, and will the online DPA or a negotiated version govern our data?
- In which Google Cloud and AWS regions are our projects, backups and compile files stored? Is an EU region available?
- Which transfer mechanism covers each US subprocessor, and do you have a transfer impact assessment?
- Beyond the email notification list, do we have a contractual right to object to new subprocessors?
- If we disable AI institution-wide, does that also stop sentence completion, Writefull suggestions and citation lookups through Dimensions?
- What do OpenAI and Anthropic retain from requests, and for how long?
- Which account type (Commons, managed Pro, unmanaged) do you recommend for staff handling unpublished research, and what happens to projects when people leave?
- Can we get the ISO 27001 statement of applicability and a completed HECVAT or equivalent questionnaire?
The EU AI Act angle
Writing assistance and LaTeX help are not among the education uses listed as high-risk in Annex III of the AI Act, Regulation (EU) 2024/1689 [13]. The relevant obligation today is AI literacy: Article 4, as amended by Regulation (EU) 2026/1744, requires deployers to take measures to support the AI literacy of staff and others using AI systems on their behalf [14]. One point needs care. If a university or teacher used AI-generated feedback from any tool to grade or evaluate students' work, that use could move towards Annex III, point 3(b), on evaluating learning outcomes. Those obligations apply from 2 December 2027 [15]. Using Overleaf's AI to fix LaTeX errors or polish a manuscript is a different matter.
Sources
- Overleaf Privacy and Terms (Terms of Service 5 May 2026, Privacy Notice 11 June 2026, Cookie Policy and Security Overview), retrieved 7 October 2026
- Overleaf data processors, Overleaf docs, retrieved 7 October 2026
- Overleaf on-premises documentation (Server Pro and Community Edition), retrieved 7 October 2026
- Data Privacy Framework List, entry for Digital Science & Research Solutions Inc.; searched for "Overleaf" with no result, retrieved 7 October 2026
- Adequacy decisions, European Commission, retrieved 7 October 2026
- AI features, Overleaf docs, retrieved 7 October 2026
- Overleaf AI features page and FAQ, retrieved 7 October 2026
- Termination and deletion, Overleaf group docs, retrieved 7 October 2026
- Digital Science security certifications, retrieved 7 October 2026
- Overleaf Commons, Overleaf docs, retrieved 7 October 2026
- Overleaf for universities, retrieved 7 October 2026
- Regulation (EU) 2016/679 (General Data Protection Regulation), Article 9, retrieved 7 October 2026
- AI Act Annex III: High-risk AI systems, AI Act Service Desk, retrieved 7 October 2026
- AI Act Article 4: AI literacy (as amended), AI Act Service Desk, retrieved 7 October 2026
- AI Act Article 113: Entry into force and application (as amended), AI Act Service Desk, retrieved 7 October 2026
About this page
We read Overleaf's terms, privacy notice, security overview, processor list and documentation, Digital Science's certification page and the European Commission's adequacy page on 7 October 2026, and searched the official Data Privacy Framework list on the same day. "Not found" means we could not find the information in public documentation; it does not mean the vendor lacks it. Plans, terms and features change, so confirm the current position with Overleaf before relying on it.
This page describes public documentation and gives our own analysis. It is not legal advice and it is not a statement that the tool is or is not GDPR compliant, which depends on your contract, configuration and use. If you work for Overleaf or Digital Science and see an error, please contact us and we will correct it.
Frequently asked questions
Is Overleaf GDPR compliant?
No tool is GDPR compliant on its own. Overleaf is run by Digital Science UK Limited, names an EU representative in Germany, publishes a list of data processors and says it complies with the GDPR and UK GDPR. Whether a university's use complies depends on its licence agreement, the account type its staff use and whether AI features are enabled.
Where does Overleaf store data?
Overleaf's security overview says it uses Google Cloud Platform for data storage, and every hosting provider on its data processor list (Google Cloud, AWS, Heroku and MongoDB Atlas) is listed with a US location. An EU-only hosting option for the cloud service was not found in public documentation (checked 7 October 2026). Overleaf also offers on-premises versions.
Does Overleaf use my documents to train AI?
Overleaf's terms say it will not use AI inputs or outputs to train or develop AI models without consent, except where this is part of the service provided to you and for your exclusive benefit. Its documentation says some AI features send content to third parties including OpenAI, that users are asked to accept AI terms first, and that the providers' contracts do not allow training on that content.
Can a university switch off Overleaf AI?
Yes, according to Overleaf's documentation. Group subscription administrators can make AI features unavailable to members, and institutions with an Overleaf Commons licence can ask Overleaf support to disable AI for all members. Individual users can also disable AI features in their account settings.
Is Overleaf on the EU-US Data Privacy Framework?
Overleaf's US affiliate, Digital Science and Research Solutions Inc., was an active participant in the EU-US Data Privacy Framework and the UK Extension on 7 October 2026, according to the official list. The UK operating company, Digital Science UK Limited, is not a US company and so is not on that list.