GDPR check

Is RefWorks (now EndNote Fusion) GDPR compliant? What universities should check

RefWorks is a cloud reference manager that universities license for all their students and staff. On 6 October 2026 it was renamed EndNote Fusion. This page sets out what Clarivate publicly documents about contracts, retention, security, AI features and transfers, and what that means for an institution renewing or reviewing its licence.

Published 7 October 2026 · Sources checked 7 October 2026

Short answer

RefWorks became EndNote Fusion on 6 October 2026. Accounts, references and settings moved across automatically. Unlike most reference managers, it is sold to institutions: libraries control accounts through approved email domains or single sign-on, and admins can switch individual features off. Clarivate's data processing addendum lists EndNote Fusion by name, makes the university the controller and incorporates the EU Standard Contractual Clauses. Clarivate's product list shows ISO 27001 and ISO 27701 for RefWorks, and a retention article gives a 120-day deletion period after cancellation. We did not find the hosting region or the AI subprocessors. Clarivate is not on the Data Privacy Framework list.

Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers reference management and a research library with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data

What Clarivate documents publicly

Everything in this table comes from Clarivate's own pages, its EndNote Fusion and RefWorks help centres or the official Data Privacy Framework list, read on 7 October 2026. Numbers in brackets refer to the sources at the end of the page.

Topic	What the vendor states	Source
Product and company	RefWorks came from ProQuest, which Clarivate lists among its brands. It was renamed EndNote Fusion on 6 October 2026, with "no changes to authentication workflows" and all accounts, references, attachments and sharing permissions transferred automatically. Clarivate describes EndNote Fusion as a single cloud platform bringing together EndNote and RefWorks.	[1] [2] [11]
Cloud and institution model	Cloud only. Users register with an authorised institutional email domain or through Shibboleth or OpenAthens single sign-on. Admins can enable, disable or promote users.	[3]
Where data is stored	Not found publicly The hosting country or region. The security overview describes redundant servers across "multiple availability zones" and attachments in durable cloud storage.	[4]
Data processing agreement	Documented Clarivate's DPA (version 3.1, September 2026) lists "EndNote Fusion Hosting, technical support and associated services", with library patrons, staff, faculty, students, researchers and alumni as data subjects. Client is controller, Clarivate is processor. Breach notice within 48 hours. Special category data is excluded unless listed.	[5]
Subprocessors	Partly documented Available through Clarivate's privacy centre sign-up form or on request. The Copyleaks checker stores data primarily on Google Cloud Platform, according to the help centre.	[5] [6] [7]
International transfers	Documented The DPA incorporates the 2021 SCCs and the UK Addendum. Clarivate does not appear on the official DPF list. ProQuest LLC, RefWorks' former publisher, is listed with an inactive, lapsed status.	[5] [8]
Retention and deletion	Documented Customer data is deleted 120 days after account deactivation or cancellation; the customer has 30 days to download data first.	[9]
AI features and training	Research Assistant (Key Takeaway, chat with a PDF, translation) is included at no extra cost "when enabled by the institutional admin". It uses "multiple enterprise-level LLMs", which are not named. Clarivate says it does not use customer or user content to train Clarivate-owned or third-party generative AI.	[10]
Institution controls	Documented Admin switches for Research Assistant, the Copyleaks plagiarism and AI content checker, sharing full text outside the organisation, Dropbox sync and other features.	[3]
Security certifications	Documented Clarivate's product compliance list shows ISO 22301, 27001, 27017, 27018, 27032 and 27701 for RefWorks, and TX-RAMP Level 1.	[11]

Clarivate deserves credit here. RefWorks has long been built for institutions rather than individuals, and EndNote Fusion keeps that model: domain-restricted sign-up, single sign-on, user management and feature switches give the university real control. A fixed, published deletion period is rare among reference managers. The ISO 27701 privacy certification listed for RefWorks goes beyond the ISO 27001 that most competitors show. Research Assistant is available only when the institutional admin enables it, which leaves that decision with the university.

What this means for research and teaching

Validemic's analysis

The rename is a good moment to review the contract. The product name, the URLs, the add-in names and possibly the governing documents have changed. If your RefWorks agreement referred to ProQuest terms or an older DPA, check that it now incorporates Clarivate's DPA version 3.1, which names EndNote Fusion. Also check that your records of processing and privacy notices name the product correctly.

Processor relationship. Because the university licenses the service for its users, Clarivate acts as processor under Article 28 GDPR [12] for most of the data, which is what an institution normally wants. Clarivate still processes some data as an independent controller for billing, account management and internal reporting [5], so that part belongs in the privacy notice to students.

Hosting and transfers. The missing piece is the hosting region. Clarivate's DPA includes the SCCs as a fallback, and Clarivate is not DPF-certified. If data is hosted outside the EEA, the university will need a transfer impact assessment under Chapter V GDPR [12]. Ask Clarivate before renewal.

AI features with third parties. Research Assistant sends PDF content to unnamed LLMs, and the Copyleaks checker sends manuscripts to Copyleaks' Google Cloud infrastructure. Both can be switched off. Turn on only what you have assessed, and tell users which services receive their documents.

Students' manuscripts. Students may upload theses and drafts that include participant quotes. The DPA excludes special category data under Article 9 GDPR [12], so guidance should say that such material stays in approved research storage. For an institution-wide AI rollout, a DPIA screening under Article 35 is sensible. Try our DPIA screening tool.

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

Questions to ask Clarivate at renewal

Does our RefWorks agreement now incorporate Clarivate's DPA version 3.1 for EndNote Fusion, or do we need to sign an update?
In which country and cloud region is our institution's EndNote Fusion data hosted, and can it be kept in the EU?
Which subprocessors process EndNote Fusion data, including the LLM providers behind Research Assistant?
Are Research Assistant and the Copyleaks checker switched off by default for our institution?
What does Copyleaks retain from scanned documents, and under which agreement with Clarivate?
Did the migration from RefWorks change where data is hosted or which subprocessors are used?
Can we receive the ISO 27001 and ISO 27701 certificates that cover RefWorks and EndNote Fusion?
How do we export all users' data at the end of the contract within the 30-day window?

An EU-built option

Looking for a European tool for reference management and a research library?

Kahubi is an AI research workspace built by Avidemic AB, a company registered in Sweden. Researchers use it to import their library through Zotero sync, BibTeX or RIS, read and question their papers, and cite them in the manuscript in their own citation style.

Runs on servers in the European Union, under EU law end to end
Your papers, data and recordings are never used to train AI models
For institutional customers, every subprocessor is a European company processing data in the EU

Explore Kahubi See Kahubi's subprocessors

Disclosure: Kahubi and Validemic are both built by Avidemic AB. Assess any tool, ours included, against your own institution's requirements.

The EU AI Act angle

Summarising and translating research papers is not one of the high-risk education uses in Annex III [13]. The Copyleaks checker needs more thought. Annex III point 3(b) covers AI systems intended to evaluate learning outcomes, and point 3(d) covers monitoring prohibited behaviour of students during tests [13]. A checker that students run on their own drafts is unlikely to fall under either. A university that uses AI-content scores to judge students' work should assess that use carefully, because the Annex III obligations will apply from 2 December 2027 under the amended Article 113 [14]. Article 4 on AI literacy, as amended, already asks deployers to take measures to support the AI literacy of staff [15]. AI-content detection is a good example of where staff need to understand the limits of the tool.

Sources

Introducing EndNote Fusion, EndNote Fusion Help Center, updated 6 October 2026, retrieved 7 October 2026
EndNote Fusion FAQs, RefWorks Help Center, retrieved 7 October 2026
EndNote Fusion Admin guide, retrieved 7 October 2026
EndNote Fusion security overview, retrieved 7 October 2026
Clarivate Data Processing Addendum, EU SCCs and UK Addendum, version 3.1, September 2026, retrieved 7 October 2026
Clarivate Privacy Center: your rights and choices (subprocessor list sign-up), retrieved 7 October 2026
Copyleaks Plagiarism and AI Content Checker tool, EndNote Fusion Help Center, retrieved 7 October 2026
Data Privacy Framework List, searches for "Clarivate" and "ProQuest", retrieved 7 October 2026
EndNote Fusion data retention policy, retrieved 7 October 2026
EndNote Fusion Research Assistant, retrieved 7 October 2026
Clarivate Security Compliance, product compliance list, retrieved 7 October 2026
Regulation (EU) 2016/679 (GDPR), Articles 9, 28 and 35 and Chapter V, text read from the Publications Office copy, retrieved 7 October 2026
AI Act Annex III: High-risk AI systems, AI Act Service Desk, retrieved 7 October 2026
AI Act Article 113: Entry into force and application, AI Act Service Desk (as amended by Regulation (EU) 2026/1744), retrieved 7 October 2026
AI Act Article 4: AI literacy, AI Act Service Desk, retrieved 7 October 2026

About this page

We read Clarivate's data processing addendum, privacy centre and security compliance page, and the EndNote Fusion and RefWorks help centres on 7 October 2026, and searched the official Data Privacy Framework list through its public search interface on the same day. RefWorks was renamed the day before our check, so some documents may still be catching up with the change. "Not found" means we could not find the information in public documentation; it does not mean Clarivate lacks it, and a negotiated institutional agreement may say more.

This page is not legal advice and does not say whether any particular use of RefWorks or EndNote Fusion complies with the GDPR. If you work for Clarivate and see an error, please contact us and we will correct it.

Frequently asked questions

What happened to RefWorks?

Clarivate renamed RefWorks to EndNote Fusion on 6 October 2026. Its help centre says existing accounts, references, attachments, sharing permissions, single sign-on and admin settings carry over automatically and old URLs redirect. RefWorks Citation Manager is renamed EndNote Fusion as well.

Is RefWorks GDPR compliant?

No tool is GDPR compliant on its own. Clarivate's data processing addendum lists EndNote Fusion hosting, support and associated services, with library patrons, staff, faculty, students and researchers as data subjects. The addendum makes the institution the controller and Clarivate the processor and incorporates the EU Standard Contractual Clauses. Compliance depends on the university's contract, configuration and use.

Where is RefWorks or EndNote Fusion data hosted?

Clarivate's security overview says EndNote Fusion runs across multiple availability zones with backups and durable cloud storage for attachments, but it does not name a country or region. The hosting location was not found in public documentation (checked 7 October 2026).

How long does EndNote Fusion keep data after a licence ends?

Clarivate's data retention article says customer data is deleted 120 days after account deactivation or cancellation, and the customer has 30 days to download account data before deletion.

Can a university switch off AI features in EndNote Fusion?

Yes. The admin guide lists separate institution-level switches for the Research Assistant and for the Copyleaks plagiarism and AI content checker, among other features. Clarivate says it does not use customer or user content to train generative AI.