Data zones: which data may go into which tool?

Which data may go into which tool comes down to two questions. First, whether it is personal data and how sensitive it is. Second, whether every service that processes the data on your behalf has a contract with you that covers exactly this step. In my conclusion from the contract documents, the contract with the provider of the workflow tool covers only that provider, not the AI provider you connect with your own key in a workflow.

A workflow is a stored sequence that passes data from one program to the next. Every station in it can land data with a different operator. So it is worth setting rules once instead of assessing every workflow afresh.

Three zones for your data

The zones are the author’s organising model and not a requirement of the law. They draw on Article 5 GDPR. Paragraph 1 lists six principles for processing, three of which bear directly on the choice of tool: purpose limitation, data minimisation, and integrity and confidentiality. Under paragraph 2, you as controller are responsible for compliance and must be able to demonstrate it.

• Zone 1, no personal data: price lists, product descriptions, standards texts. According to the guidance of the German data protection authorities (DSK), “Künstliche Intelligenz und Datenschutz”, such fields of use are not subject to data protection law. The DSK still calls for a thorough check, because a link to a person does not arise only from names and addresses. Trade secrets are a separate topic.
• Zone 2, personal data: customer name, address, telephone number, enquiry text, invoice data. Only tools belong here for which a contract exists and whose location is clarified, and each step receives only the fields it needs. According to the DSK, removing names from a text is regularly not enough, because the link can be established from the context.
• Zone 3, specially protected: data under Article 9(1) GDPR, for example on health, religion or trade union membership. Processing it is in principle prohibited and permitted only under the exceptions in paragraph 2. In the office it turns up inconspicuously: an enquiry about a step-free bathroom can contain details of a disability. My recommendation: do not put zone 3 into automated workflows with an external service until a data protection specialist has cleared it.

When a contract of its own is needed

Under Article 28(1) GDPR, a controller who has data processed on its behalf may work only with processors that provide sufficient guarantees of suitable technical and organisational measures. The basis is a contract which, under paragraph 3, sets out the subject matter and duration of the processing, its nature and purpose, the type of personal data and the categories of data subjects. It must be in writing, and electronic form is enough (paragraph 9). The processor may process the data only on documented instructions.

On cloud solutions the DSK writes that the external provider acts “as an extended arm on behalf of the controller”, so a processing relationship often exists, and an agreement under Article 28(3) is to be concluded (translated from the German here and below). Whoever runs an AI application solely for its own purposes on its own servers is, as a rule, the sole controller. For your workflows this gives the following picture:

Whether this applies to your set-up is for your data protection officer or data protection adviser to clarify in the individual case.

What the n8n contract covers

I read the sample agreement that n8n offers for download. It is undated, and the contract you sign may differ. The sample refers expressly to Article 28(3) GDPR and regulates, among other things: processing only on written instructions (clause 3.1), confidentiality of staff (4.1), security measures (5), notification of personal data breaches, where feasible within 72 hours of becoming aware (6.2), sub-processors (8), help with requests from data subjects (9), return or deletion (11), and records and an audit at most once in twelve months (12 and 13). Whether the clauses suffice in the individual case is not assessed in this article.

Appendix A describes the subject matter: n8n operates a tool that transfers and transforms data between third-party services. The purpose is the automation of internal business processes, and employees, customers, vendors and service providers may be affected. As categories of personal data, Appendix A lists name, email address, password, billing address, credit card information, IP address, API key, access token, identifiers, integration configuration, logs and cookies. Enquiry texts from your workflows are not expressly listed there. Annex I of the Standard Contractual Clauses, on the other hand, says the categories are determined by the data exporter at its discretion. How the two fit together, clarify with n8n and your data protection adviser.

According to the security page, the cloud runs on Microsoft Azure, and hardware and data are currently located in the EU. That is a manufacturer’s statement. The sub-processor list likewise gives the EU for Azure, for example Germany and Sweden.

What it does not cover

My conclusion is that the contract with n8n does not cover the AI provider you connect with your own key. n8n does not say so anywhere in so many words. The conclusion rests on three places.

First, the contract governs processing by n8n. Under clause 2.4 it applies only to the processing described in Appendix A, and the sub-processors in clause 8 are n8n’s own. Second, for “bring your own LLM” functions the AI Terms state that you choose AI models yourself and configure them with your own credentials, that data may be transmitted to those providers, and that you must review and accept their terms and data handling yourself. Third, the sub-processor list does include AI providers. It does not say that it extends to your own choice of provider. A provider to which your workflow sends data with your key is therefore not a sub-processor of n8n, and you need a contract of your own with it.

With self-hosted n8n the contract does not apply. The Self-Serve Terms say for this case: the installation is under your control, and n8n is not your processor. Security and maintenance are then yours.

For specially protected data: clause 2.4 requires you to notify n8n in writing if you intend to process such data, and to ensure compliance yourself. In Annex I of the Standard Contractual Clauses, under “Sensitive data transferred”, the entry is “None anticipated”.

Later changes can be steered only to a limited extent as well. If you object to a new sub-processor, clause 8.3 leaves terminating your account as the only remedy. The security measures and the sub-processor list are not in the contract itself but on web pages that can change. The contract also allows transfers outside the EEA under safeguards (7.2), and the list names n8n group companies in the USA and the United Kingdom for customer support.

The order of checks

Go through each station of a workflow one by one before real data flows.

An example with invented data

Muster-Ausbau GmbH, invented, 12 employees, wants to pre-sort enquiries from its web form. The form sits with the website provider. From there each enquiry goes to n8n Cloud, an AI step summarises the free text, and an email service delivers the summary to the office.

Four services, four contracts: website provider, n8n, AI provider, email service. The n8n contract is one of them; three lie outside it. Name and telephone number stay in the workflow, and the AI sees only the free text. That can still contain names and therefore falls into zone 2. If it says “wheelchair”, it could be health data and so zone 3.

What you can do now

1. For one workflow, write down every station that processes data and assign it a zone.
2. For each station, check whether an Article 28 contract exists and covers this step. Keep the signed contracts in one place.
3. For every AI step, read the provider’s terms on training and storage of inputs before real data flows.
4. Show the list to your data protection officer or data protection adviser. This article is not legal advice, and whether a set-up can be operated in line with the GDPR depends on the individual case.