How to Use Make.com in a GDPR-Compliant Way

Using make.com to automate data flows in your business raises important questions about privacy, data protection, and GDPR compliance. This how-to guide walks you through the practical steps you must take to use the platform in line with the EU General Data Protection Regulation.

The guidance below is based on the official information provided in the original article at make.com GDPR documentation. It explains what make.com does with personal data, which roles and responsibilities you have, and how to configure your account for compliant processing.

1. Understand How Make.com Works With Personal Data

Before you configure anything, you should understand the technical role of make.com in your data processing.

1.1 Make.com as a Data Processor

When you send personal data through scenarios, make.com acts as a data processor. That means:

• You, as a customer, remain the data controller.
• You decide which personal data is processed and why.
• Make.com processes that data only on your documented instructions.

Make sure that in your internal GDPR documentation you clearly classify make.com as a processor and record what types of data you send through the platform.

1.2 Where Make.com Processes Data

According to the original guidance, data processed by make.com is stored and handled in data centers located in the European Union. This EU hosting helps support GDPR compliance because data stays under EU jurisdiction.

However, keep in mind:

• You may connect services that store data outside the EU.
• In that case, you are responsible for ensuring appropriate safeguards, such as standard contractual clauses or other transfer mechanisms.

Always review each connected app in your scenario and document its data location and safeguards.

2. Set Up Your Contractual Basis With Make.com

GDPR requires a written data processing agreement (DPA) between controller and processor. With make.com, this is handled through its standard contractual terms.

2.1 Review the Make.com Data Processing Agreement

The platform provides a DPA that describes:

• The subject and duration of processing.
• The nature and purpose of processing.
• The types of personal data and categories of data subjects.
• Security measures implemented by make.com.

Download, review, and save the DPA with your records. Ensure it matches the actual way you use the platform.

2.2 Map Your Processing Activities

For each scenario you run on make.com, document:

• Which data is processed (for example, contact details, orders, support tickets).
• The purpose of processing (such as marketing automation or customer service).
• The legal basis under GDPR (for instance consent or legitimate interest).

Include these details in your records of processing activities and reference make.com as the processor for each relevant flow.

3. Configure Make.com for GDPR-Compliant Data Handling

Once your contractual and documentation basis is clear, configure your make.com account for data minimization and secure handling.

3.1 Limit the Personal Data You Send to Make.com

GDPR requires you to process only the data that is necessary. When designing scenarios in make.com, follow these rules:

• Include only the fields you truly need for the automation.
• Avoid sending sensitive personal data unless absolutely required and lawful.
• Pseudonymize or anonymize data before it enters scenarios whenever possible.

By limiting data at the source, you reduce risk and simplify compliance.

3.2 Control Scenario Logs and Data Retention

Scenario runs in make.com can generate logs and temporary data. According to the original article, these are kept for limited periods to troubleshoot errors and ensure platform reliability.

To stay aligned with GDPR data minimization principles:

• Regularly review scenario run history and remove unneeded data.
• Check configuration options that relate to log visibility and retention.
• Avoid storing personal data in long-term notes, comments, or descriptions inside your scenarios.

Ensure that your internal retention policy is consistent with how data flows through make.com.

3.3 Secure Access to Make.com

Security is a key GDPR obligation. On make.com you should:

• Use strong, unique passwords and enable any available multi-factor authentication.
• Assign user roles carefully and limit access to scenarios with personal data.
• Revoke access immediately when staff leave your company or change roles.

Combine these steps with your own internal security policies and training.

4. Manage Data Subject Rights With Make.com

Individuals in the EU have rights such as access, rectification, restriction, and deletion. You must be able to honor these rights when their data passes through make.com.

4.1 Locating Data in Make.com

When a data subject requests access or deletion, you may need to identify where their information appears in your scenarios. To make this easier:

• Name modules and scenarios clearly based on the data they process.
• Keep documentation that maps each data field to specific automation flows.
• Use filters and search features in connected systems to trace records that pass through make.com.

This mapping helps you respond quickly and accurately to requests.

4.2 Deleting or Correcting Data

In many cases, the primary systems of record (for example, CRM or help desk tools) will be where you handle deletion or correction. Still, review how:

• Scenario logs may contain temporary copies of personal data.
• Any stored bundles or archived outputs in make.com might include that information.

Align your procedures so that when you delete or update data in core systems, remnants in make.com are removed according to your policy and the platform’s retention capabilities.

5. Rely on Make.com Security and Compliance Measures

The original make.com GDPR article describes technical and organizational security measures designed to protect processed data. While you cannot control these directly, you should be aware of them and integrate them into your risk assessment.

5.1 Review Security Documentation

As part of your vendor risk management:

• Read the security and compliance section of the make.com website.
• Verify measures such as encryption, network security, access controls, and monitoring.
• Record these controls in your internal security documentation for audits.

If needed, add your own supplemental measures around how your team uses the platform, such as stricter access policies or additional monitoring.

5.2 Plan for Incident Response

GDPR requires you to detect, investigate, and report personal data breaches. With make.com in your stack:

• Include the platform in your incident response plan.
• Record how you will collect logs and evidence if a scenario misroutes or exposes data.
• Use the communication channels described by make.com to report or receive incident information.

Ensure all relevant staff know the steps to take if they suspect an issue involving scenarios or integrations.

6. Keep Your Make.com GDPR Setup Up to Date

Automation environments evolve quickly. New scenarios, apps, or team members can change your risk profile. To maintain ongoing GDPR compliance with make.com, embed regular reviews into your governance.

6.1 Periodic Reviews and Audits

Every few months, or when you deploy major updates, perform a quick audit:

1. List all active scenarios handling personal data.
2. Check data fields against the principle of data minimization.
3. Verify user access and remove any unnecessary permissions.
4. Confirm that retention practices are still appropriate.

Update your internal processing records and, if necessary, your legal documentation.

6.2 Align Make.com With Your Overall Data Strategy

Make.com is one component of your wider automation and data ecosystem. To keep everything consistent:

• Ensure your privacy policy accurately reflects the use of make.com as a processor.
• Coordinate changes in connected systems so that data flows remain transparent and lawful.
• Train your team regularly on both GDPR principles and how they apply to automations.

When you need help designing compliant workflows or reviewing complex automation stacks, you can turn to specialist consultancies such as Consultevo for additional guidance.

7. Summary: Using Make.com Responsibly Under GDPR

To use make.com in a GDPR-compliant way, you must combine the platform’s technical safeguards with your own legal, organizational, and security responsibilities. Follow these core steps:

• Classify make.com correctly as a data processor.
• Review and sign the data processing agreement.
• Minimize and protect the personal data you send through scenarios.
• Enable secure access, retention limits, and clear documentation.
• Support data subject rights and incident response procedures.

By following the guidance drawn from the official make.com GDPR article and aligning it with your own policies, you can confidently automate workflows while respecting privacy and regulatory requirements.

Need Help With Make.com?

If you want expert help building, automating, or scaling your Make scenarios, work with ConsultEvo — certified workflow and automation specialists.

Get Help