A GDPR compliant social media management tool is one that lets you, the controller, meet your own duties: a processing agreement under Article 28, a public subprocessor list, a legal basis for every transfer outside the EEA, and deletion you can trigger yourself. No badge or "EU-hosted" label proves that. Ten checks against the vendor's own documents do, and they take about 30 minutes per tool.
This is a practitioner's guide, not legal advice. Every rule below links to the article it comes from, so you or your data protection officer can verify it.
What makes a social media management tool GDPR compliant?
A tool cannot be compliant on its own, because the GDPR puts the duties on whoever decides why and how personal data is processed. That is you. The tool is your processor, and Article 28(1) says you may use only processors that give sufficient guarantees. A compliant tool is one that hands you those guarantees in writing.
A scheduling tool holds more personal data than most teams expect:
- names and email addresses of your team members
- commenters' public names, handles and comments, once you connect an inbox
- DM contacts and whatever your automations collect, such as email addresses or phone numbers
- email sign-ups from a link-in-bio page
- everyone who is visible or audible in the videos you upload
All of it counts as personal data under Article 4(1), which covers any information relating to an identifiable person, online identifiers included.
Who is responsible for what when you post through a tool?
You are the controller, the tool is your processor, the tool's own vendors are subprocessors, and each social network is a separate controller that receives what you publish. Each relationship needs a different piece of paper, and mixing them up is the most common mistake in vendor reviews.
| Party | GDPR role | What it does | What you need |
|---|---|---|---|
| You (brand, creator business) | Controller | Decides what is posted and whose data is in it | A lawful basis, a privacy notice, a record of processing |
| The tool | Processor | Stores, schedules and publishes on your instructions | An Article 28 contract (the DPA) |
| The tool's vendors (hosting, email, AI) | Subprocessors | Run parts of the tool | Your authorisation, through the subprocessor list |
| The networks | Independent controllers | Get what you publish, under their own terms | Nothing from the tool; their terms apply to you directly |
The DPA covers the top row of the chain. The networks sit outside it.
Two cases change the picture.
Facebook Pages. In case C-210/16 the Court of Justice held that the administrator of a Facebook fan page is jointly responsible with Facebook for processing the data of visitors to the page. Joint controllers must set out who does what in an arrangement under Article 26. No scheduling tool changes that. It is between you and Meta.
Agencies. If you post for clients, the client is the controller and you are the processor. Your tool then becomes a subprocessor, and Article 28(2) forbids you from engaging one without the client's prior written authorisation. If you run client workspaces and approvals in the tool, name it in each client's contract.
How do you check a tool in 30 minutes?
Open three documents from the vendor's site: the data processing agreement, the subprocessor list and the security page. Then work through the ten rows below. If a document is missing or sits behind a sales call, treat that as your first finding.
| # | Check | Rule | Pass | Red flag |
|---|---|---|---|---|
| 1 | A DPA exists and you can get it signed | Art. 28(3) | Published terms, signed copy on request | "We are GDPR compliant" with no contract |
| 2 | Subprocessor list is public | Art. 28(2) | Every vendor with purpose and location | "Trusted partners", no names |
| 3 | You hear about new subprocessors first | Art. 28(2) | Notice in advance and a right to object | The list changes silently |
| 4 | Hosting location is stated | Art. 44 | App, database, media and backups each named | "Cloud infrastructure" |
| 5 | Every non-EEA vendor has a transfer basis | Art. 45, 46 | Adequacy decision or standard contractual clauses, per vendor | A US vendor with no mechanism named |
| 6 | Security measures are written down | Art. 32 | Token encryption, two-factor sign-in, access limits | A padlock icon |
| 7 | Breaches are reported to you | Art. 33(2) | "Without undue delay" in the DPA | No breach clause |
| 8 | Deletion has dates | Art. 28(3)(g) | Days for media, tokens, account data and backups | "Data may be retained" |
| 9 | Help with data subject requests | Art. 28(3)(e) | Export and delete per contact, or support on request | You cannot find one person's data |
| 10 | AI features name their provider | Art. 28(2) | Provider listed, training use excluded | AI features, no AI vendor on the list |
Row 7 matters more than it looks. When a breach happens, you have 72 hours to notify the supervisory authority under Article 33(1), and the clock starts when you become aware. A processor that tells you late eats your deadline.
Row 10 is new territory for most reviews. Caption suggestions, reply drafts and transcription send your content, and sometimes your commenters' words, to a model provider. That provider is a subprocessor like any other and belongs on the list.
Score it plainly. Ten passes and you can file the review. One or two gaps are questions for the vendor. A missing DPA or an unnamed transfer mechanism ends the evaluation.
Does the tool have to be hosted in the EU?
No. The GDPR does not require EU hosting. It requires that every transfer of personal data out of the EEA rests on one of the grounds in Chapter V: an adequacy decision under Article 45, or appropriate safeguards such as the Commission's standard contractual clauses under Article 46(2)(c). EU hosting settles the question for the core service. The vendors behind it still need checking.
That last point is where "EU-hosted" marketing gets thin. A tool can keep its database in the EU and still send email through a US provider, error reports to a US monitoring service and AI prompts to a US model. Each of those is a transfer, and each needs its own basis.
For US vendors, the usual basis since 10 July 2023 is the EU-US Data Privacy Framework: personal data can flow to US companies that participate in it. The General Court dismissed an action to annul the framework in case T-553/23 in September 2025. That ruling was appealed to the Court of Justice as case C-703/25 P, so check where the appeal stands before you rely on the framework alone. Vendors that name both the framework and standard contractual clauses have a fallback.
Run this for each subprocessor on the list:
- Find the country where it processes data.
- EU or EEA: no transfer rules apply. Move on.
- A country with an adequacy decision: allowed under Article 45. The Commission keeps the list of decisions.
- United States: search the company on the Data Privacy Framework list. If its listing is active, the transfer is allowed under Article 45. Note the date you checked.
- Otherwise: look for standard contractual clauses in the DPA. Allowed under Article 46. Ask for the clauses.
- None of these: a red flag. Ask the vendor, or walk away.
Four questions per subprocessor. Stop at the first yes.
What should you ask a vendor before you sign?
Send the questions the documents did not answer, in writing, so the reply goes into your file. A vendor with its paperwork in order can answer every one of them with a link.
Subject: Data protection questions before we sign up
Hello,
we are evaluating [tool] for our social media and act as the
controller under the GDPR. Before we connect any accounts, please
send or link:
1. Your data processing agreement under Art. 28 GDPR, and how we
get a signed copy.
2. Your current subprocessor list with purpose and location of
each, and how you announce changes.
3. Where the application, database, uploaded media and backups
are hosted.
4. For each subprocessor outside the EEA: the transfer mechanism
(adequacy decision, Data Privacy Framework, standard
contractual clauses).
5. How access tokens for our social accounts are stored, and
what happens to them when we disconnect a channel.
6. Your deletion periods for media, account data and backups
after we cancel.
7. How and how fast you notify customers of a personal data
breach.
8. Which AI providers process our content, and whether it is
used to train models.
Thank you,
[name, company]
Keep the reply with the DPA and a dated copy of the subprocessor list. That folder is your evidence that you chose a processor with sufficient guarantees.
What does a filled-in check look like?
Here is the same check run on reelport.io, using what its security page and DPA page state. It is a fair example because it is not spotless: the core service is in the EU, and five subprocessors process data in the United States.
| # | Check | reelport.io |
|---|---|---|
| 1 | DPA | Terms published; signed copy on request by email |
| 2 | Subprocessor list | Public, with purpose and location per company |
| 3 | Changes | Customers with a DPA are told in advance and can object |
| 4 | Hosting | Application and database on Hetzner servers in the EU; media in Helsinki, Finland; nightly backups in a private EU bucket, kept 14 days |
| 5 | Transfers | Five subprocessors process data in the US: server provisioning, transactional email, AI features when used, error monitoring and the bug tracker. Each is listed with the Data Privacy Framework, standard contractual clauses or both. The payment provider is an Irish company with group companies in the US |
| 6 | Security | TLS in transit; channel tokens encrypted with AES-256; API tokens stored as SHA-256 hashes; two-factor sign-in and passkeys; owner, admin and member roles |
| 7 | Breaches | Reported to the customer without undue delay |
| 8 | Deletion | Media 30 days after its last post; channel tokens at once on disconnect; team data 30 days after the team is deleted, backups within a further 14 days |
| 9 | Data subject requests | Help with requests is part of the DPA |
| 10 | AI | Provider named on the list; not used for training; only called when you use an AI feature |
Read row 5 the way you would for any vendor. Uploaded media stays on the EU servers unless you use an AI feature on it, such as alt text, which sends the image to the AI provider. The US vendors each have a named purpose and mechanism. Whether that is acceptable is your call as controller, and the documents give you what you need to make it.
What stays your job after you pick the tool?
The DPA covers the processor. These seven items stay with you, whichever tool you choose:
- Add the tool to your record of processing activities (Article 30), with its subprocessors as recipients.
- Name the tool, or the category "social media management software", among the recipients in your privacy policy.
- If you are an agency, list the tool as a subprocessor in every client contract.
- Give each person their own login, turn on two-factor sign-in, and remove people the day they leave. Per-channel access and roles keep freelancers out of accounts they do not work on.
- Have a lawful basis for what your automations collect. A DM flow that asks for an email address needs to say what the address is for.
- Decide how you answer a deletion request from a commenter or DM contact, and test it once in your inbox and your Chat contacts.
- Diary a re-check: once a year, and whenever the vendor announces a new subprocessor.
The fines explain the order of priority. Breaches of the processor rules in Article 28 fall under Article 83(4): up to 10 million euros or 2 % of worldwide annual turnover. Unlawful transfers fall under Article 83(5): up to 20 million euros or 4 %. The contract and the transfer check are the two rows you cannot skip.
Where reelport.io fits
reelport.io is a social media workspace made by Pixel & Process in Lübeck, Germany, with the application, database and media hosted in the EU. Publishing, the comment inbox, Chat automations and Link in Bio pages run under one data processing agreement and one subprocessor list, so you review one vendor where you might otherwise review four. Link-in-bio pages set no cookies and count visits without storing IP addresses.
The documents this post told you to ask for are public. Start with security and the DPA, then run the ten rows yourself.