Is Salesforce GDPR Compliant?
Verdict: Yes — one of the more mature GDPR compliance programmes among US cloud providers
Salesforce has invested significantly in GDPR compliance and has a well-developed programme for European customers. EU data centres, a comprehensive DPA, and strong privacy controls make it suitable for European enterprise use.
Key Compliance Features
Data Processing Addendum: Salesforce's DPA is incorporated by reference into their Master Subscription Agreement. You do not need to separately request it — it applies automatically to all commercial customers.
EU Data Centres: Salesforce operates data centres in Germany and France. EU data residency is available — request it when setting up your instance or contact your account manager.
Einstein AI: Salesforce's AI features (Einstein GPT, Agentforce) process data within your Salesforce instance under the same DPA protections. Einstein does not use your CRM data to train shared models without explicit consent.
Agentforce (2026): Salesforce's autonomous AI agents launched in 2025-2026. Available with EU data processing. DPA covers Agentforce operations.
Your Obligations as a Salesforce Customer
As the data controller, you are responsible for what data you store in Salesforce and what you do with it. Common compliance gaps include:
- Data minimisation: Only store personal data you actually need
- Retention policies: Configure Salesforce data retention to match your privacy policy
- Right to erasure: Have a process for deleting individual contact records on request
- Data subject access requests: Know how to export all data related to a specific individual
- Third-party integrations: Every AppExchange app you install may add new data processors — review each one
Einstein AI and the EU AI Act
Salesforce's AI features used in HR contexts (hiring, performance management) may fall under EU AI Act high-risk classification. Ensure you have human oversight documentation in place if using Einstein for any people-related decisions.
Practical Steps
- Confirm your Salesforce instance is on EU data centres
- Review and understand the Salesforce DPA
- Configure data retention and deletion rules
- Map all Salesforce data flows in your GDPR Article 30 records
- Review AppExchange integrations for their own GDPR status
[Browse GDPR-compliant productivity tools on stckfndr →](/?category=productivity&compliance=gdpr)