Is Loom GDPR compliant? What a data protection officer checks in 2026
Steffen Rosenögger, Founder of CapmePublished November 5, 2026
Loom under the GDPR, checked against Atlassian's own DPA, sub-processor list and residency page: ten rows, what each says, what you set.
In short
- As of November 2026 an existing Loom workspace cannot be switched to Frankfurt, and its videos cannot be moved to a new one.
- Loom's contracting party is Loom, Inc., a US subsidiary of Atlassian, so a company under US law runs a Frankfurt workspace too.
- Atlassian announces new sub-processors only to email addresses that subscribed, so the DPO's mailbox has to be on that list.
Atlassian's published documents answer most of what a DPO asks about Loom; three answers depend on the Loom plan and one on the date the workspace was created. Atlassian is the processor under its data processing addendum and sends some data to the USA on standard contractual clauses and the EU-US Data Privacy Framework. Whether yours complies depends on the region, plan and settings you pick.
Does the Frankfurt region make Loom GDPR compliant?
The Frankfurt region keeps a new Loom workspace's content in Germany, and some data still leaves the EU. Atlassian's residency page says "Loom does not export or process raw customer content (video, audio, or transcript payloads) outside your selected region for normal product operation." Which sub-processors still receive content from a Frankfurt workspace is open; question 1 in the template below asks.
| Data or service | Where |
|---|---|
| Videos, comments, transcripts, AI summaries and documents, workspace settings | Frankfurt (hosted on AWS) |
| Sign-in, sessions, user settings, organisation membership | Global, no region named |
| Audit logs (IDs only), notifications, history, Watch Later | Global, no region named |
| Transcription (Speechmatics) | USA per the list; whether it serves Frankfurt workspaces is not stated |
| Email and mobile notifications (Mailchimp, OneSignal), analytics (Twilio Segment), support (Zendesk) | USA |
| Support (PartnerHero) | Philippines, Romania, South Africa |
| Loom AI (OpenAI), machine learning (Databricks) | USA |
Stored AI output stays in Frankfurt; neither page says whether OpenAI processes the recording in the USA to produce it; question 1 below asks.
Whatever still goes to the USA rests on the EU-US Data Privacy Framework and on standard contractual clauses. The General Court upheld the framework in September 2025; the appeal, C-703/25 P, was still pending at the Court of Justice in November 2026 (any US vendor: GDPR guide to video messaging).
The region sets where content is stored; the operator's home country sets which laws can reach it. Loom, Inc. is a US subsidiary (privacy policy), and Atlassian's transfer impact assessment, updated 30 November 2024, names FISA Section 702 and Executive Order 12333 and points to the CLOUD Act. We think your own assessment should cover the Frankfurt workspace too, because those laws address the company running it.
Who can choose Frankfurt, and how is it set?
Frankfurt is open to new Loom workspaces only, and Atlassian names no plan for it. The availability table on the residency page, read on 1 November 2026, has these rows:
- New standalone Loom customers: yes, the region is picked when the workspace is set up.
- Existing Jira or Confluence customers adding a new Loom workspace: yes, through Atlassian Administration.
- Existing Loom workspaces: no; migration is planned for a later release, and videos cannot be moved into a new resident workspace.
An admin picks the region in the "Select data location" field while provisioning the workspace; afterwards Data management, Data residency shows it. As of November 2026 it cannot be changed later. A company on Loom since 2023 starts empty in Frankfurt. If the old videos hold personal data you must keep, keep the old workspace and document its transfers; if they are short-lived, record new videos in Frankfurt and delete the old workspace once nobody needs them.
Which contract covers Loom, and who is the processor?
For a company using Loom, Atlassian is the processor. The Atlassian Data Processing Addendum, effective from 17 August 2026, says so and is part of the Atlassian Customer Agreement, which has covered Loom customers since their next order, renewal or 1 May 2024, whichever came first (Atlassian, April 2024). The product terms of 1 October 2026 name Loom, Inc. as the contracting entity, and for customers domiciled in Europe the Customer Agreement is governed by Irish law.
File the current Atlassian version in place of any earlier Loom DPA (now archived), and check against Article 28(3) GDPR that its descriptions, written for all Atlassian cloud products, cover recordings, transcripts and AI output.
What does a DPO check in Loom, row by row?
A Loom review covers ten points, each answered by a public Atlassian document. The table gives that answer and what you do with it.
| Check | What Atlassian's document says | What you do |
|---|---|---|
| Processor contract | DPA effective 17 August 2026, part of the Customer Agreement, no signature | File this version with its date |
| New sub-processors | DPA: notice at least 30 days ahead, sent to subscribed emails; an objection ends in terminating the order | Subscribe the DPO mailbox |
| Transfers to the USA | DPA: EU standard contractual clauses, Module Two (Three if you are a processor yourself); Atlassian certified under the Data Privacy Framework; a transfer impact assessment is published | Attach the assessment to your file |
| AI features | AI settings: on by default in Business+AI and Enterprise; an admin can switch them off for everyone | Decide before rollout |
| Retention | Retention rules: only on Enterprise and Business+AI, in Atlassian-managed workspaces; counted from creation, deletion is permanent | On other plans, write a manual deletion routine; how long to keep recordings |
| Deletion | Deletion page: the owner's delete is immediate and permanent; support cannot restore | Name who handles erasure requests |
| Public links | Privacy settings: default privacy is public unless an admin changes it; restrictions on who may share publicly only on Enterprise and Business+AI | Set the default to workspace only |
| Activity log | Activity logs: Business, Business+AI, Enterprise; logins, video deletions and other actions, exportable as CSV | Decide who reads it and how long exports are kept |
| Security and certificates | Security measures: AES-256 at rest, TLS 1.2 or higher; Loom among the products on the ISO/IEC 27001:2022 page; a SOC 2 Type II report for Loom listed | Request the SOC 2 report |
| Breach notice | DPA: without undue delay and, where feasible, within 72 hours | Plan for your own 72 hours under Art. 33 running at the same time |
Three rows depend on the plan: automatic deletion and limits on public sharing need Business+AI (Premium on Atlassian's privacy page) or Enterprise, which also switch AI on by default; the activity log starts on Business.
For a data protection impact assessment under Article 35, weigh screen recordings that show whatever was open, Loom AI, and the per-user activity log.
How does Capme answer the same checklist?
Capme Meetings, the meeting platform that ends status meetings (viewers are free on company plans), answers several rows differently; EU storage is no longer one of the differences, since Loom offers Frankfurt too. As checked in Capme's code in November 2026, Capme's DPA, on the Commission's Article 28(7) clauses, is accepted with a tick box when a trial or plan starts. Capme's DPA names 6 subprocessors, 2 of them with a route outside the EEA.
| Check | Loom | Capme |
|---|---|---|
| Contracting party | Loom, Inc. (USA); Irish law for customers in Europe | Capme Digital GmbH, Düsseldorf |
| Video storage | Frankfurt or Oregon, new workspaces only; account data global | Germany and Sweden (Bunny.net), delivered worldwide; own S3 bucket on Business |
| Transcription and AI | Transcripts via Speechmatics; AI on by default in Business+AI and Enterprise | None: Capme does not transcribe or summarise |
| Public links | Public by default until an admin changes it | Off when a company workspace is created |
| Own retention window | Business+AI and Enterprise, Atlassian-managed workspaces | Solo and Business, 1 to 365 days; Team stays at 365 |
| SOC 2, ISO 27001 | SOC 2 Type II report listed; on Atlassian's ISO 27001 page | Neither; no independent penetration test yet |
An admin sets up a Business workspace in four steps before the first meeting, ideally with the DPO. On Team only step 2 applies: the window stays at 365 days, and audit export and own bucket are Business features.
- In Admin, Recording and sharing, under "How long is a recording kept?": shorten the window from 365 days to, say, 90. It applies to recordings made from then on, and a video marked keep stays until someone deletes it.
- On the same tab, leave Public links at Off, where a company workspace starts: nothing in the workspace opens without a sign-in.
- In Admin, Data, download the audit log as CSV when you need it; entries are deleted after 365 days.
- Optionally connect your own S3 bucket, also under Data: recordings go there from the browser, Capme never holds the video file, and a lifecycle rule on the bucket sets how long they stay.
If your policy requires a SOC 2 report from the vendor, Loom passes that row and Capme does not. Capme's documents are in its Trust Center.
Which Loom security questions should you send Atlassian before signing off?
Atlassian's published documents leave six questions open. Send them in writing and keep the answers with the review; the six general questions for any video vendor cover the rest.
We would watch question 5 most closely. The DPA lets Atlassian keep data under "its standard backup or record retention policies" and names no period. If Atlassian names one, add it to your erasure record.
Frequently asked questions
- Does rolling out Loom in Germany need the works council?
- Usually yes. Loom's activity log records logins and deletions per user, which can monitor behaviour, and that is what § 87(1) no. 6 BetrVG covers. Our guide to works councils and video tools covers the agreement.