Log inSubmit a tool

Is Bitwarden UK GDPR compliant?

answer from its trust card · not checked yet

> short_answer

Bitwarden handles customer data, so it acts as a supplier under UK GDPR. You’ll want a contract that covers processing, and to check where the data goes. The facts below are from its trust card.

No tool is “compliant” on its own; compliance depends on how you use it. This page shows the facts you need to decide.

The facts that matter for UK GDPR

Data to vendor: Only encrypted vault data: it’s end-to-end encrypted and Bitwarden can’t read it (zero-knowledge).○ unclaimed
Data location: United States or European Union: you choose when you create the account or organisation, and it stays there.○ unclaimed
Certifications: ISO 27001, SOC 2 Type II, SOC 3; annual third-party code audits and penetration tests○ unclaimed

What you still need to do

  1. Add it to your record of processing. Pre-filled entry
  2. Check your contract covers processing and any transfers abroad. DPIA starter
  3. Watch it, so you hear if any of this changes. Watch Bitwarden