How Miro handles personal data on behalf of business customers is governed by a separate Data Processing Addendum, and Miro discloses the third parties it uses to process data in a separate subprocessors list that can change over time.
This analysis describes what Miro's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
For business customers under GDPR or other data protection laws, the DPA is the operative legal instrument defining Miro's obligations as a data processor, and the subprocessors list determines which third parties may access the personal data you upload to Miro.
Interpretive note: The adequacy of the DPA for specific regulatory frameworks such as GDPR Article 28 or CCPA service provider requirements depends on the full content of that addendum, which is a separate document and was not available for review in this analysis.
If your organization is subject to GDPR, CCPA, or similar data protection law, Miro's Data Processing Addendum governs its obligations as a processor of your customers' and employees' personal data, and changes to the subprocessors list may affect whether your data transfer and vendor management obligations remain satisfied.
How other platforms handle this
We may access, preserve, and share information with regulators, law enforcement, or others if we believe it is reasonably necessary to: detect, prevent, and address fraud and other illegal activity; protect ourselves, you, and others, including as part of investigations; and prevent death or imminen...
Customer authorized Mistral AI to transfer Personal Data to any country deemed to have an adequate level of data protection by the European Commission. Customer also authorizes Mistral AI to perform International Data Transfers to (a) on the basis of adequate safeguards in accordance with Applicable...
Personal data collected by Unity may be transferred to and processed in countries outside of the European Economic Area, including the United States, where data protection laws may differ from those in your country. Where we transfer personal data from the EEA or the UK, we rely on appropriate safeg...
Monitoring
Miro has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"Miro's processing of personal data on behalf of customers is governed by the Customer Data Processing Addendum, which is incorporated into these Terms by reference. A current list of subprocessors used by Miro is available at miro.com/legal/subprocessors-list/ and is updated from time to time.— Excerpt from Miro's Miro Terms of Service
REGULATORY LANDSCAPE: The Customer Data Processing Addendum is the primary instrument for GDPR Article 28 compliance in Miro's B2B relationships. Organizations acting as controllers must ensure the DPA contains all required GDPR provisions, including subject matter and duration of processing, nature and purpose of processing, type of personal data and categories of data subjects, and obligations and rights of the controller. The CCPA's service provider regime similarly requires a written contract limiting the service provider's use of personal information. GOVERNANCE EXPOSURE: High for enterprise customers in GDPR or CCPA-regulated contexts. The adequacy of the DPA and the currency of the subprocessors list are ongoing compliance obligations, not one-time reviews. Changes to the subprocessors list may require controller notification to data subjects or impact transfer mechanism adequacy assessments. JURISDICTION FLAGS: EU/EEA organizations face the highest exposure, as GDPR imposes strict requirements on controller-processor agreements and international data transfers. Organizations transferring personal data to Miro from the EU must confirm that appropriate Standard Contractual Clauses or equivalent transfer mechanisms are in place. UK organizations must comply with UK GDPR and the UK's international transfer framework. CONTRACT AND VENDOR IMPLICATIONS: Legal and procurement teams should execute the Customer Data Processing Addendum as a standalone agreement (if not already incorporated automatically), review the subprocessors list against their own vendor management requirements, and implement a process to receive and assess Miro's advance notice of subprocessor changes as required by GDPR Article 28. COMPLIANCE CONSIDERATIONS: Organizations should conduct a Transfer Impact Assessment for data transfers to Miro if required by their jurisdiction. The DPA should be reviewed annually or upon material changes to Miro's data processing practices. Data subject rights requests relating to personal data processed by Miro should be assessed in the context of the DPA's provisions on controller instructions.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
For business customers under GDPR or other data protection laws, the DPA is the operative legal instrument defining Miro's obligations as a data processor, and the subprocessors list determines which third parties may access the personal data you upload to Miro.
If your organization is subject to GDPR, CCPA, or similar data protection law, Miro's Data Processing Addendum governs its obligations as a processor of your customers' and employees' personal data, and changes to the subprocessors list may affect whether your data transfer and vendor management obligations remain satisfied.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Miro.