Collabora Online and GDPR

No. Collabora Online does not write a record of processing activities for you, and the controller must maintain one that covers document editing as a processing activity. Record the purposes, categories of data subjects and personal data (names and content inside documents), recipients, retention and security measures. Confirm with your counsel or data protection officer which fields your register requires under the GDPR, because the Article 30 text is not reproduced here. The editor adds no separate data category of its own, so the entry should describe the WOPI host as the system holding the files and note that Collabora Online processes document content in memory during editing. Review the entry whenever you add an integration or change where documents are hosted.

The inventory maps where document content travels and where it rests. Start with the browser, the WOPI host (for example Nextcloud), the Collabora Online server and any reverse proxy, then mark the location of each component. Record every hop that crosses a border, including remote administrator access, log shipping to a third-country service and backups. Under EDPB Guidelines 05/2021, remote access from a third country, even only displaying data on a screen, counts as a transfer, so include support sessions in the inventory. If you use an AI assistant from Collabora Online 26.04, which is off by default, record the chosen provider and whether it is hosted externally or on your infrastructure. Your team must add the vendor list, the legal basis for each transfer and the review date.

Keep exports of the group settings that decide who can open and who can edit documents. In Nextcloud Office, administrators can limit which groups may use the editor and which groups may edit rather than only view, so export that configuration on a fixed schedule and after every change. Store the exports with the change ticket and the approver's name. The WOPI host holds the identity and group data, so also keep the directory group membership that feeds those rules. Collabora Online itself does not manage your user accounts, so the team must add the access review process, the owner of each group and the record of leavers removed from groups.

Keep a dated log of every running version on every server, and of every advisory that applies to it. The 25.04 release notes record that 25.04.7.5, released January 29, 2026, fixed CVE-2026-23623, and that package signing keys were updated for RPM and DEB users. A useful entry names the version deployed, the date deployed, the advisory identifier, the date the fix was applied and the person who verified it. Collabora publishes these notes on its release notes page, so the log should cite them and the date you checked them. The team must add the subscription to advisories, the patching window and evidence that the old version was retired.

The controller must be able to notify the supervisory authority of a personal data breach and, where the risk is high, notify the affected individuals. Articles 33 and 34 set those duties, and the controller must keep its own record of each incident, its facts, its effects and the remedial action taken. For a Collabora Online deployment, record which logs would show unusual access, such as WOPI host access logs and Collabora Online server logs, how long they are kept and who reviews them. Include the contact path to the processor or hosting provider and the decision steps for deciding whether to notify. Confirm the notification timelines and the content requirements with counsel, and have the team test the procedure before an incident occurs.

Keep the contracts and assurances from each processor and supplier involved in the deployment. Where a third party processes personal data on your behalf, the controller needs a written arrangement and a record of who the processor is, where it operates and which sub-processors it uses. For Collabora Online, record the licence terms (the server code is licensed under MPL-2.0) and which edition you run. Under the Business plan, support includes signed security updates and customer portal access, and the pricing page states the per-user monthly cost for up to 99 users, which you should confirm against the current page before budgeting. Record the agreement, the subscription terms, the renewal date and the exit plan in the same file.

Retention periods are a decision for your legal team, and the GDPR does not supply a fixed period for the register itself, so confirm the period with counsel. Assign one owner for each record: the data protection officer or compliance lead for the register and breach log, the platform team for version and configuration exports, and the WOPI host administrator for access exports. Keep the records in a system that shows version history and who changed each entry. The GDPR does not require an audit or certificate, but records that show regular review are the evidence supervisory authorities are most likely to ask for, and they support any voluntary certification you pursue later.

No. Self-hosting does not make an organization GDPR compliant by itself. The GDPR has no certificate or audit that confirms compliance, and certification under Article 42 is voluntary and does not reduce the controller's or processor's responsibility. Self-hosting helps because you decide where documents are processed and who can reach the editor, which supports your Article 32 security of processing duties. You still need a lawful basis, records of processing, processor terms with your suppliers, transfer assessments where data leaves the EEA, and a way to handle breaches under Articles 33 and 34. Collabora Online does not store documents on the editor, but personal data still lives in your WOPI host, which remains in scope.

The cost depends on the written scope, and a quote follows from that scope. The main cost components are the time of the people reviewing the data flows, the number of hosts and integrations involved, the document types and categories of personal data in scope, and whether transfers outside the EEA need analysis. Work usually includes mapping where documents and metadata are processed and stored, reviewing the WOPI host configuration, checking supplier terms, and preparing records. Ongoing costs can include Collabora subscriptions: the Business plan costs 3 euros per user per month for up to 99 users, according to the Collabora Online pricing page, and it includes a service level agreement and signed security updates. Ask any partner for a fixed-scope quote that lists deliverables and exclusions in writing.

Duration depends on how many systems are in scope, how well your current data flows are documented, and how quickly your legal and security teams can answer questions. Expect the work to depend most on access to the people who own the WOPI host, the identity provider, storage and backups, and the contracts with each supplier. Your team will typically need to confirm which document categories are edited, who can open and edit them, where logs and backups are kept, and which countries staff access the system from. A written scope should state the timeline and the dependencies on your side. Ask for the timeline in the quote rather than relying on general estimates.

Yes, many organizations do this with internal staff, especially where the data protection officer and security team already maintain records of processing and a data inventory. The work requires knowledge of GDPR Chapter IV on controller and processor duties and Chapter V on transfers, plus hands-on access to the Collabora Online server, the WOPI host and its configuration. Internal teams often lack time for the technical review of logs, allow lists and TLS settings, or for drafting transfer analyses. A hybrid model is common: internal staff own the legal decisions and records, while an implementation partner documents the configuration and produces evidence. Whichever model you choose, the controller remains accountable for the outcome.

Collabora's server processes documents in memory while a user edits them, and self-hosting means the server runs in your infrastructure, so Collabora as a vendor does not receive your documents by default. Confirm this in writing, because the answer depends on your deployment and any support, telemetry or AI features you enable. Some features, such as the optional AI assistant introduced in 26.04, can send content to a provider if you choose a hosted AI service, so check that choice against your transfer analysis. Personal data also remains in the WOPI host and storage system, which are outside the editor. Ask whether any support session would require remote access from a third country, since EDPB Guidelines 05/2021 treat that as a transfer.

Ask for written answers on several points before you sign. For Collabora, ask which data, if any, leaves your environment during installation, updates, support, telemetry or AI features, and whether a data processing agreement is available with standard contractual clauses where needed. For your hosting provider, ask where data is stored and processed, which staff can access it, whether support involves remote access from outside the EEA, how they respond to government access requests, and what happens to data on exit. Also ask about the notice and transition terms for switching, since the Data Act gives customers switching rights for data processing services. Request written evidence of security updates, such as how Collabora publishes advisories and signing key changes, so your records show how patches are handled.

Article 83(5) sets fines of up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher, for infringements of Articles 44 to 49 on transfers to third countries. This is the level named in the GDPR itself, and it is why transfer questions belong in the assessment scope. Infringements of Articles 25 to 39, which cover security of processing and breach notification among others, carry a lower maximum of EUR 10 million or 2% of turnover under Article 83(4). Self-hosting reduces the number of transfer paths you must review, but you still need to verify each supplier and support route, so ask for a quote that covers those checks explicitly.