Project Management Software GDPR: A 2026 Buyer’s Guide

The short answer

To make project management software GDPR-compliant, sign an Article 28 data processing agreement, confirm where data is stored and which subprocessors touch it, ensure the tool can export and delete a person’s data on request, restrict access by role, and document what personal data you keep and why. If the vendor hosts outside the EU/EEA, add SCCs or buy an EU data region. Internal projects are full of employee data, so “it’s only for our team” is not an exemption.

Does GDPR apply to internal project data?

Yes, and this is the misunderstanding that causes most of the trouble. Teams assume GDPR is about marketing lists. It is about any identifiable person, and your delivery board is full of them.

Article 3 covers an EU-established organisation for all its processing, and a non-EU organisation when it offers goods or services to people in the EU or monitors their behaviour. A US agency with three contractors in Lisbon is in scope. So is a Dubai firm running a project for a German client.

What counts as personal data in a project tool is broader than a contact list:

• Names, work emails, phone numbers, job titles, and photos in user profiles.
• Free-text comments and status updates that mention a person’s performance, health, or conduct.
• Time entries and utilisation rates, which become performance data the moment a manager reads them.
• Client contact records, including personal mobile numbers in a custom field.
• Attachments: a signed contract, an ID scan, a medical certificate.

Special category data under Article 9 — health, trade union membership, ethnicity, biometrics — needs an additional legal basis. A “sick leave” field with a reason dropdown is exactly what turns an ordinary task tool into a high-risk system.

> Important note: GDPR does not ban storing personal data in a project tool. It requires a lawful basis, minimisation, a retention limit, and a contract with the vendor. Most failures are missing paperwork, not forbidden data.

Who is the controller and who is the processor?

You are the controller. The vendor is the processor. That split decides who does what when something breaks.

The controller decides why and how data is processed: which fields exist, who sees them, how long they stay. The processor acts only on your documented instructions and must not use the data for its own purposes — including training AI features on project content unless the contract allows it.

The practical consequence: “our vendor is GDPR certified” answers a question you did not ask. Certification covers the vendor’s housekeeping. It does not cover your decision to store passport scans in a task attachment.

What must a GDPR-compliant DPA contain?

Article 28(3) lists eight mandatory elements, and a surprising number of vendor DPAs miss two or three — usually subprocessor change notice and audit rights.

1. Documented instructions only. The vendor processes data solely on written instruction, including transfers to third countries.
2. Confidentiality. Anyone with access is under a duty of confidentiality.
3. Security. Measures under Article 32 — encryption, resilience, restore capability, regular testing.
4. Subprocessors. Prior authorisation, notice of changes, and the same obligations flowed down in writing.
5. Assistance with data subject rights. Help to answer access, rectification, erasure, and portability requests.
6. Assistance with Articles 32–36. Security, breach notification, impact assessments, prior consultation.
7. Deletion or return. At the end of the contract, delete or return everything and confirm it.
8. Audit and information. Provide what is needed to demonstrate compliance and allow audits.

Two clauses deserve extra attention in 2026 because they are where project tools differ most.

AI training. Many tools now offer summarisation, task generation, and meeting notes. Ask whether your content trains models, whether it is retained for that purpose, and how to switch it off. Get the answer in the DPA, not a help-centre article.

Subprocessor change notice. If the DPA lets the vendor change subprocessors with no notice, you cannot meet your Article 28(2) duty to approve them. Look for 30 days’ notice and a documented objection right.

Where is your project data actually stored?

Data location is the question buyers ask and vendors answer vaguely. Make it specific, in writing, per feature.

Three lawful arrangements exist. EU/EEA hosting keeps data in the region — the simplest position. A US or global host with Standard Contractual Clauses plus a transfer impact assessment is lawful but needs documented reasoning. A US host relying on the EU-US Data Privacy Framework needs no SCCs for certified importers, because that framework is an adequacy decision.

It was adopted on 10 July 2023 and extended to the EEA in 2024, and has been under pressure since: the Data Protection Review Court lost members in January 2025, and a US Supreme Court ruling in June 2026 (`Trump v. Slaughter`) removed the protections the framework depended on. NOYB has said it will seek annulment. That does not make the framework invalid today, but “we rely only on the DPF” needs stress-testing. Ask for SCCs as a fallback in the same contract.

Verify each one at renewal; residency moves between tiers more often than privacy policies change.

What happens when there is a breach?

You have 72 hours from becoming aware to notify the supervisory authority, unless the breach is unlikely to result in a risk to rights and freedoms. If it is likely to result in a high risk, you must also tell the affected people without undue delay.

The clock starts when you become aware, not when the vendor finishes its investigation. That is why the DPA must require notification “without undue delay” with enough detail to assess risk — which data, which people, how many, what containment has already happened.

Two habits save hours later. Keep a breach register with dates, decisions, and reasoning, even for incidents you decide not to report: the decision is evidence of accountability. And pre-draft the notification template, because the 72-hour window rarely falls in a calm week.

How do you handle a data subject request inside a project tool?

A controller must respond within one month, extendable by two further months for complex requests, per Article 12(3). The work is search and judgement, not legal analysis.

An access request means finding every mention of a person, including comments, attachments, custom fields, and audit logs. An erasure request means deleting the person and deciding what happens to project history that references them — you cannot delete a task a client signed off, but you can strip the personal data inside it.

Build the path before you need it:

• Search. Test whether search finds a name inside comments and attachments, not just in the people directory.
• Export. Confirm one person’s data exports in a readable format within minutes.
• Delete. Check whether deletion is soft (recoverable from a bin) or hard, and how long backups keep the record.
• Anonymise. For historical data, replacing a name with a role label is usually the right answer.

Keep a one-page runbook naming who searches, who approves, and who replies.

What are your records and retention obligations?

Article 30 requires a record of processing activities. For a project tool that is a short, honest page: what data, which people, what purpose, which systems, how long, who has access, and which transfer mechanism applies.

Retention is where project tools quietly break the rules. Tasks live forever by default, and a three-year-old board still holds a contractor’s name, a salary note, and a client’s personal mobile. Article 5(1)(e) requires that data be kept no longer than necessary, so set a period per data type and enforce it: archive completed projects after 12 months, delete after 24 or 36, and strip personal fields from archived boards.

Three calculations that size the real cost

Example 1: the 72-hour breach. A 250-person company discovers on a Friday at 22:40 that a misconfigured board exposed 3,400 user profiles and 12,000 client contact records. The deadline is Tuesday 22:40. Realistic effort: 10 hours of security scoping, 6 of legal triage, 3 of drafting, 5 of communication — 24 internal hours at a blended €65 is €1,560, plus 12 hours of external counsel at €350 is €4,200. Roughly €5,760 before any fine, and a working audit log would have halved the scoping.

Example 2: the erasure request. An employee leaves and asks for erasure. Their data sits in six systems. At 45 minutes of search per system (270 minutes), 90 minutes of review, and 60 minutes of verified deletion, the request costs 7 hours. Four a month is 28 hours — 3.5 working days of capacity, every month. A tool with person-level export and delete turns the 45 minutes into about 5.

Example 3: the exposure you are weighing. A company with €40 million turnover faces a maximum under Article 83(5) of €20 million or 4% of global turnover, whichever is higher: 4% is €1.6 million, so the ceiling is €20 million. Tier-two infringements under Article 83(4) — including Article 28 contract failures — cap at €10 million or 2%, here €800,000. Compare that with the subscription: 250 seats at $17 per user monthly is 250 × 17 × 12 = $51,000 a year, and the residency upgrade that removes the transfer question is usually quote-only at enterprise level. Assume 1.5–2× that and ask for the number in writing. Enforcement is not theoretical: Ireland’s Data Protection Commission fined Google €403 million in September 2026.

Where does Doitify fit?

Doitify is our platform, so weigh this section accordingly. It is built for teams that need project controls — tasks, WBS dependencies, sprints, workload, budgets, and client-ready reports — in one system rather than a tool plus three spreadsheets.

On GDPR, ask us the same questions this article lists, in writing: hosting location, subprocessors, what the DPA says about AI features, and how person-level export and deletion work. The useful part: tasks, access roles, the audit trail, and the archive sit in one place, so a retention rule is applied once instead of across five tools.

Trade-off: a smaller vendor has a smaller compliance team and less accumulated paperwork than a hyperscaler. If your organisation needs a specific certification or a redline process only large suppliers absorb, confirm that before signature.

Who does not need to worry about this?

Some teams over-engineer this and stall a rollout. If any of these is true, a lighter process is defensible.

• The tool holds no personal data. A schedule of milestones with no names is genuinely low-risk.
• You already have a group-level DPA and residency agreement. You are checking whether the tool is covered, not negotiating from scratch.
• You are a sole trader with no employees. Obligations still exist for client data, but the machinery can be proportionate.
• Everything sits in the EU with an EU processor. No transfer mechanism is needed; the DPA and retention rules still are.

> Common mistake: Treating GDPR as a one-time procurement checkbox. The DPA sits in a folder, the subprocessor list changes twice a year, and nobody notices the new AI meeting-notes feature was switched on for everyone by default.

What should you do in the first 30 days?

Week 1 — map it. List every project tool, who owns it, and what personal data it holds. Include the free tools teams signed up for without telling anyone; those have no DPA at all.

Week 2 — paper it. Request the DPA, subprocessor list, residency confirmation, and a written answer on AI training. A vendor who cannot produce a DPA is a decision, not a delay.

Week 3 — restrict it. Turn on role-based access, remove personal fields from templates, replace free-text notes with structured options, and delete the fields nobody uses.

Week 4 — document it. Write the Article 30 record, set the retention rule and archive job, and file the DSAR runbook. Diarise a review for the same month next year.

Conclusion

GDPR compliance in project management software is not a legal mystery. It is four documents and four habits: a signed Article 28 DPA, a residency and subprocessor confirmation, a transfer mechanism where needed, and a retention rule — plus role-based access, a DSAR runbook, a breach register, and a yearly review.

Do that before the rollout and it costs a week. Do it after an incident and it costs a quarter, a fine, and the credibility of everyone who called the tool “just for internal use.” Start with the system holding the most personal data, and ask the vendor for the paperwork in writing.

If this post on project management software GDPR was helpful, you might also enjoy Project Management Software for Research Teams: 2026 Guide and Client Onboarding Project Template.