Is Zotero GDPR compliant? What universities should check

Zotero is the reference manager many European libraries recommend first. This page sets out what Zotero publicly documents about local storage, optional syncing, groups, hosting, contracts and transfers, and what that means for a university deciding how staff and students may use it.

Published 7 October 2026 · Sources checked 7 October 2026

Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers reference management and a research library with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data

What Zotero documents publicly

Everything in this table comes from Zotero's own pages or the official Data Privacy Framework list, read on 7 October 2026. Numbers in brackets refer to the sources at the end of the page.

Zotero deserves credit for several things a data protection officer looks for. Local storage is the default, not an add-on. The privacy policy lists exactly which automatic requests the software makes and how to switch each one off. Retention periods are stated in days and months rather than in general terms. The client and server code are open source and can be audited, and the security page openly says the server can be self-hosted, though without support.

Groups change the picture

Zotero groups are how research teams and classes share libraries. Groups can be private (hidden, invitation only), public with closed membership, or public with open membership. In public groups, administrators choose whether the library is visible to non-members, and private and closed groups can also share files [4]. Group file storage counts against the group owner's storage plan [4], and syncing is required to use groups at all [3].

For a university, that means group libraries always sit on Zotero's US servers. The owner of the group, often a single researcher's personal account, controls membership and deletion. Zotero itself suggests that a team set up a separate account to own the group so it is not lost when someone leaves [4].

What this means for research and teaching

A reference library is usually low-risk data, but not always. Bibliographic metadata about published papers is mostly public information. The personal data at stake is the user's account and what they add: notes, annotations, attached PDFs and, in some fields, documents that should never be in a reference manager. Interview transcripts, consent forms or draft papers containing participant quotes can easily end up attached to a library item. Health, political or other sensitive data in such files is special category data under Article 9 GDPR [7].

Local use and synced use are different decisions. Used locally without an account, Zotero processes very little personal data on its own servers, and the university's normal endpoint rules apply. Once a user syncs, Zotero becomes a cloud service in the United States. We found no DPA, no DPF certification and no stated transfer mechanism. For an institution that pays for Zotero Institution storage and directs staff to use it, the processor obligations in Article 28 GDPR [7] and the transfer rules in Chapter V become relevant. That is a question to raise with CDS directly before signing.

Individual accounts. Most researchers sign up for Zotero themselves. In that case the user, not the university, is the account holder, and the university has no contract with the vendor. That is a reasonable arrangement for public bibliographic data, and a poor one for confidential research material.

DPIA likelihood. Routine reference management will rarely need a data protection impact assessment under Article 35 GDPR [7]. A synced group library holding sensitive attachments for a large project could. Use our DPIA screening tool for a first view.

Practical guidance. Many institutions can support Zotero well with simple rules: local use is fine; sync only bibliographic data and published PDFs; keep confidential files in university storage and link to them rather than attaching them; and use WebDAV on a university server for personal file sync where available.

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

Questions to ask the Corporation for Digital Scholarship

1. Will you sign a data processing agreement with our university for Zotero Institution storage, and which entity signs it?
2. What transfer mechanism do you rely on for personal data synced from the EU to AWS in the United States?
3. Is there, or will there be, an option to store our institution's synced data in an EU region?
4. Which service providers, beyond those named in the privacy policy, can access synced library data or files?
5. Are accounts created before encryption at rest was introduced now encrypted, and can existing data be migrated?
6. Can our institution see which accounts are covered by our Zotero Institution plan and remove leavers?
7. When a user deletes their account, how long do copies remain in backups (the policy says up to six months)?
8. Do you have any independent security assessment or questionnaire, such as a HECVAT, that you can share?

The EU AI Act angle

Zotero is not an AI tool in the sense of the EU AI Act, and the documentation we read describes no generative AI features. Premium Read Aloud voices use text-to-speech providers [1], which is speech synthesis rather than a decision about people. None of the education uses listed as high-risk in Annex III (admission, evaluating learning outcomes, assessing the level of education, or monitoring students during tests) applies to reference management [8]. Those Annex III obligations now apply from 2 December 2027 [9]. Article 4 on AI literacy, as amended, asks deployers to take measures to support the AI literacy of their staff [10]. That is relevant if a university pairs Zotero with plugins or other tools that do use AI.

Sources

1. Zotero Privacy Policy, last updated 18 May 2026, retrieved 7 October 2026
2. Zotero Terms of Service, last updated 13 June 2026, retrieved 7 October 2026
3. Zotero Security, retrieved 7 October 2026
4. Zotero Groups documentation, retrieved 7 October 2026
5. Zotero Storage FAQ and Zotero Storage, retrieved 7 October 2026
6. Data Privacy Framework List, searches for "Digital Scholarship" and "Zotero", retrieved 7 October 2026
7. Regulation (EU) 2016/679 (GDPR), Articles 9, 28 and 35 and Chapter V, text read from the Publications Office copy, retrieved 7 October 2026
8. AI Act Annex III: High-risk AI systems, AI Act Service Desk, retrieved 7 October 2026
9. AI Act Article 113: Entry into force and application, AI Act Service Desk (as amended by Regulation (EU) 2026/1744), retrieved 7 October 2026
10. AI Act Article 4: AI literacy, AI Act Service Desk, retrieved 7 October 2026

About this page

We read Zotero's privacy policy, terms of service, security page, groups documentation and storage pages on 7 October 2026, and searched the official Data Privacy Framework list through its public search interface on the same day. Every statement about Zotero above comes from those pages. Where we give our own view, it is labelled as Validemic's analysis. "Not found" means we could not find the information in public documentation; it does not mean the Corporation for Digital Scholarship lacks it, and a contract may say more than the public pages do.

This page is not legal advice and does not say whether any particular use of Zotero complies with the GDPR: that depends on your configuration, contract and what users store. If you work on Zotero and see an error, please contact us and we will correct it.