Is Vercel GDPR Compliant? The DPA, Regions and Hobby Gap (2026)

Vercel has a Data Processing Addendum, and it's the document a GDPR question really turns on. The catch is in its first section: it applies "for Customers who are on Enterprise and Pro plans." If you launched on a free Hobby account, there's no DPA covering you.

That's the first thing to check. The second is that your functions run in Washington, D.C. by default, whatever continent your users are on.

What Vercel commits to

Vercel's Security and Compliance docs say it "supports GDPR compliance" and list five commitments:

• appropriate technical and organizational security measures around customer data,
• notifying customers of breaches "without undue delay",
• imposing similar obligations on its sub-processors,
• responding to data subject requests for access, correction and deletion,
• relying on the EU Standard Contractual Clauses and the UK Addendum for transfers outside the EEA.

The same page says Vercel is certified under the EU-U.S. Data Privacy Framework, holds a SOC 2 Type 2 attestation, and is ISO 27001:2022 certified. That's a normal, credible processor posture. Nothing in it is unusual for a US cloud provider.

What it isn't is a statement that your app is compliant. Vercel's role is processor. You're the controller, and the controller owns the lawful basis, the privacy notice, the consent banner and the list of vendors.

The DPA, read closely

The Data Processing Addendum (last updated March 17, 2026, effective March 31, 2026) is short enough to read in one sitting. Four lines in it matter most for a small team.

Who it covers. Section 1 says it applies to Vercel's processing "for Customers who are on Enterprise and Pro plans." Hobby isn't mentioned.

How it takes effect. It's incorporated into the agreement and becomes binding on "Customer entering into the Agreement or upon execution of this Addendum". There's nothing to countersign on Pro.

Where processing happens. Section 13.1: "as of the Effective Date, Vercel's primary processing facilities are in the United States." Vercel may also process data anywhere it or its sub-processors operate.

Sub-processor changes. The list lives at security.vercel.com. You don't get notified of new sub-processors by default: you have to email privacy@vercel.com to subscribe. If you object within five calendar days and can't reach agreement, your remedy is to terminate.

The Hobby gap

Vercel's fair use guidelines restrict Hobby "to non-commercial personal use only", and define commercial broadly: taking payments, advertising a product, running ads, or being paid to build the site all count.

So a vibe-coded SaaS on a Hobby account has two problems stacked on top of each other. It's outside Vercel's terms, and it has no processor agreement covering the EU personal data in its request logs. Upgrading to Pro fixes both, and it's the first thing to do before an EU customer asks who your processors are.

Where your data actually runs

Vercel's function region docs are explicit: "By default, Vercel Functions execute in Washington, D.C., USA (iad1) for all new projects."

GDPR doesn't require EU hosting. Transfers to the US are lawful under the SCCs and the Data Privacy Framework, both of which Vercel relies on. But if a customer's vendor questionnaire asks where personal data is processed, this is the cheapest answer to change:

{
  "$schema": "https://openapi.vercel.sh/vercel.json",
  "regions": ["fra1"]
}

Vercel's EU compute regions are fra1 (Frankfurt), cdg1 (Paris), dub1 (Dublin) and arn1 (Stockholm). lhr1 is London, which is UK GDPR rather than EU. Hobby gets a single region; Pro gets up to five.

Put the function next to your database. An EU function querying a Supabase project in us-east-1 still sends the personal data across the Atlantic on every request, and adds latency while it does it.

Two limits on what the setting buys you, both from Vercel's own docs:

• Routing Middleware runs everywhere. "Vercel deploys Routing Middleware to all regions by default, regardless of your region settings." If your middleware reads a session cookie or logs a user ID, that happens at whichever region served the request.
• It moves your functions, not Vercel. The compliance page says customers can "select their preferred region for deploying their code", and in the same breath that Vercel "may transfer data to and in the United States". The DPA puts Vercel's primary processing facilities in the US. Pinning a region is a real improvement, not a residency guarantee.

Logs, analytics and previews

These are where a GDPR question turns into a configuration question.

Runtime logs hold personal data. Vercel's runtime log docs list the request user agent and search params in every log entry, and the "Logs from your browser" filter works by "matching your IP address and User Agent". Retention is short: 1 hour on Hobby, 1 day on Pro, 3 days on Enterprise, 30 days with Observability Plus. Whatever you console.log lands there too, so log IDs, not request bodies. If you add a Log Drain to Datadog or Axiom, that vendor is now a processor with its own DPA to sign.

Web Analytics is designed to be light. Vercel's Web Analytics privacy page says it uses no third-party cookies, identifies visitors "by a hash created from the incoming request", and discards the visitor session after 24 hours. The weak spot is your URLs. A route like /invoice/jane-doe/123 records Jane's name in your analytics. Strip it before it leaves the browser:

import { Analytics } from '@vercel/analytics/next';

<Analytics
  beforeSend={(event) => {
    const url = new URL(event.url);
    url.pathname = url.pathname.replace(/\/invoice\/[^/]+/, '/invoice/[customer]');
    url.searchParams.delete('email');
    return { ...event, url: url.toString() };
  }}
/>

Previews often run on production data. A preview deployment that connects to your production database is processing real EU personal data on a URL your whole team, and sometimes a client, can open. Give Preview its own database and check vercel env ls preview for production credentials.

A GDPR checklist for a Vercel app