If you are in the EU or UK, you have rights under GDPR including the right to access your data, have it deleted, correct inaccuracies, restrict processing, receive a portable copy, and object to certain processing.
GDPR grants EU and UK users among the strongest data privacy rights in the world, and Figma must legally honor these requests in a timely manner.
Figma's designation of a data controller and reliance on SCCs for international transfers creates accountability under GDPR Articles 13-15 (transparency), Article 17 (erasure), and Article 20 (portability). DPO engagement and Article 30 Records of Processing Activities (ROPA) compliance should be verified in enterprise procurement due diligence.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Figma collects a broad range of personal data including usage patterns, device information, and payment details, and may use this data for AI/ML model improvement and targeted advertising. Your design content and collaboration activity may be processed and shared with third-party service providers and advertising partners. You can submit a privacy rights request (access, deletion, opt-out of data sale/sharing) through Figma's privacy request form at https://www.figma.com/privacy-request/.