Odoo GDPR Compliance: Hosting, DPA, Access Rights and a Checklist

Most articles on Odoo and GDPR stop at "host it in the EU". Real Odoo GDPR compliance also depends on your contract, your user roles and every system that touches the database. Our Odoo consulting services start with that full data map.

Related service: DevOps and hosting services — Odoo.sh, self-hosting and CI/CD run by people who do it daily.

This guide is for owners, IT leads and data protection officers running Odoo 19 or Odoo 20 with EU personal data. It is practical guidance, not legal advice. For the hosting basics, see our comparison of Odoo Online, Odoo.sh and on-premise hosting.

Is Odoo GDPR compliant?

Odoo can be run in a GDPR compliant way, but compliance is something your company achieves, not a feature you switch on. GDPR, called DSGVO in German-speaking countries, puts the duties on the controller, and that is you.

Odoo's own GDPR guide says the same. It tells customers to map their processing, publish a clear privacy policy, answer data subject requests within one month and prepare an incident response procedure.

So the honest answer has three parts:

• The vendor: Odoo SA signs data protection clauses, names its subprocessors and publishes its security measures.
• The software: Odoo 19 and 20 ship access controls, a contact lookup and deletion tool, and consent features for websites.
• Your setup: hosting, roles, retention, integrations and staff habits are yours to design and prove.

Who is the data controller and processor in Odoo?

You are always the data controller for your Odoo database, and Odoo SA is a processor only when it hosts or handles that database. The split changes with the hosting option.

Odoo states that "the owner of the database is the data controller". On-premise, a hosting company or implementation partner with server access becomes your processor instead, so you need a data processing agreement with them.

This matters for Odoo data protection audits. An auditor will ask for a contract with every party that can read the database, not only with Odoo.

Odoo hosting and GDPR: Odoo Online vs Odoo.sh vs on-premise

All three Odoo hosting options can meet GDPR; they differ in who does the security work and who you must trust. Odoo.sh and on-premise hosting sit in the Custom plan on the Odoo pricing page.

For the cloud, Odoo's security page lists AES-256 encryption at rest, HTTPS in transit, a dedicated database per customer and salted PBKDF2 and SHA-512 password hashing. Odoo also takes part in the CSA STAR program.

The Odoo Cloud Hosting SLA targets 99.9% uptime with a recovery point objective of 24 hours. Put that figure in your own risk assessment, because up to a day of work could be lost in a disaster.

On-premise gives full control and full responsibility. Odoo's deployment guide tells you to run behind HTTPS, block the database manager, avoid demo data and keep builds updated. If nobody on your team owns that list, the cloud is the safer GDPR choice.

Where is Odoo data stored? Odoo data residency by region

Odoo cloud databases are stored in the hosting region closest to you, and you can ask for a different main region, subject to availability. The Odoo privacy policy lists the locations.

Three details matter for Odoo data residency:

• Backups: the policy says it is not possible to choose or restrict the backup locations.
• Version: EU-only backups currently apply for new customers using Odoo 19.0 or later, so older European databases should ask Odoo where their backups sit.
• Subprocessors: hosting runs on OVH and Google Cloud, and you can choose the region but not the provider.

Odoo staff in subsidiaries outside the EU may access data for support, and Odoo says it binds them with EU Standard Contractual Clauses. Record that transfer in your processing register.

What does the Odoo DPA cover?

The Odoo DPA is section 6.5, Data Protection, of the Odoo Enterprise Subscription Agreement, and it applies whenever Odoo SA processes your database. There is no separate form to sign for a standard subscription.

In the Odoo Enterprise Subscription Agreement, Odoo SA commits to:

• Instructions: process personal data only as you instruct and only to perform the services.
• Confidentiality: make sure authorised staff are bound to confidentiality.
• Security: keep appropriate technical and organizational measures in place.
• Requests: forward promptly any data protection request it receives about your database.
• Incidents: notify you promptly once it confirms unauthorized access or disclosure.
• Audits: provide the information needed to show compliance and contribute reasonably to audits.
• Deletion: delete or return all copies of your database at the end of the agreement, unless the law requires retention.

Check the timing. After you cancel, the database is kept deactivated for 3 weeks, and personal data can remain in backups for up to 12 months. Under GDPR Article 33 you still have 72 hours to report a breach to your authority.

What data does the Odoo license check send?

A self-hosted Odoo Enterprise database sends a weekly update notification to Odoo with usage counts and company contact details, not your business records. Many privacy reviews miss this flow.

The on-premise documentation says the notification runs once a week. Odoo 18.0 and above call services.odoo.com on port 80, and you can switch to port 443 with one configuration line.

Odoo's open source code for versions 19 and 20 shows the fields in the message:

1. Database UUID, database name and creation date.
2. Odoo version, interface language and the base web address.
3. Counts of users, active users, portal users and active portal users.
4. In Odoo 20, counts of Light Users and active Light Users.
5. Names of installed apps and the Enterprise subscription code.
6. The company name, email and phone number.

An Odoo forum thread asked for the exact data sent for the subscription check and received the same list. Customer, employee and invoice records are not part of it.

The agreement requires you to keep this check running unmodified, so do not block it. Add it to your record of processing as a transfer of company contact data to Odoo SA in Belgium.

How do Odoo access rights support GDPR?

Odoo access rights let you limit each user to the apps and records they need, which is the core of GDPR's data minimization and security duties. Set them up on purpose; the defaults are too open for HR and payroll data.

Odoo 20 assigns each user a role (User, Administrator or Light) and then groups per app. The access rights documentation describes levels such as "User: Own Documents" and "User: All Documents".

A practical setup order for Odoo 19 and 20:

1. List who needs personal data: HR, payroll, sales, support and finance.
2. Give sales and support users "Own Documents" unless they manage a team.
3. Keep Administrator and the Access Rights setting to two or three named people.
4. Turn on two-factor authentication for every internal user.
5. Set a minimum password length with the Password Policy module.
6. Review each user's device list and archive leavers the same day.
7. Give customers and vendors portal access, never an internal login.

Never let staff share a login, because you lose the audit trail. We cover this in our post on Odoo shared user accounts. For approvals and logs, see our guide to Odoo internal controls.

On Odoo Online, the database manager also shows admin activity logs, including actions taken by Odoo employees. On Odoo.sh, give each GitHub collaborator the lowest role that works: Developer, Tester or Admin.

How do you handle data subject requests in Odoo?

Odoo handles access and erasure requests through the Privacy Lookup action, standard exports and the Data Recycle rules. You still decide what the law lets you delete.

Privacy Lookup arrived in the Odoo 16 release as an action "to find all occurrences of a Contact and archive/delete them if necessary". It installs with the mail module, searches by name and email, and keeps a privacy log.

A workable process for a request:

• Verify: confirm the identity of the person before you send or delete anything.
• Find: run Privacy Lookup on the contact and review each linked record by model.
• Export: use list-view export for the records the person is entitled to receive.
• Erase or archive: delete what has no legal basis, and archive what must stay.
• Document: keep the privacy log and your reply as proof you answered within one month.

Posted invoices and payroll entries usually cannot be erased, as bookkeeping laws require you to keep them. Odoo's own agreement notes that deletion may be restricted by law. Explain that in your reply.

For retention, the Data Cleaning app includes recycle rules that find outdated records and archive or delete them. Use them for old leads, applicants and inactive contacts.

Which Odoo integrations and AI features move personal data?

Every connector, website tracker and AI feature that reads your Odoo database is a data flow you must record. Hosting in the EU does not cover what leaves through integrations.

• Website: enable the cookies bar; it blocks third-party tracking services until a visitor accepts optional cookies and creates a cookie policy page.
• Email marketing: keep the unsubscribe link and blacklist active so consent withdrawals stick.
• In-app services: SMS, document digitization and partner autocomplete send data to Odoo IAP providers.
• AI in Odoo 20: AI features run on Odoo AI IAP credits, so prompts leave your database even when you self-host.
• Connectors: shipping, payment, marketplace and bank links each need their own agreement.
• Test copies: use neutralized duplicates, and note that a duplicate still holds real personal data.

Our breakdown of Odoo 20 AI features and IAP credits lists the services. If a connected system is breached, follow our steps for Odoo API key rotation.

Version matters for security too. Odoo supports each major version for three years, so with Odoo 20 released, 18, 19 and 20 receive fixes. Our post on unsupported Odoo version security risks explains the exposure.

Odoo GDPR compliance checklist for Odoo 19 and 20

Work through these ten checks and you will have the evidence most auditors and customers ask for. Assign an owner and a review date to each one.

1. Data map: list every Odoo app holding personal data, the purpose and the legal basis.
2. Hosting record: note the hosting option, region, backup locations and Odoo version.
3. Contracts: file the Odoo agreement and a DPA for each host, partner and connector vendor.
4. License check: record the weekly update notification as a data flow if you self-host.
5. Access: review roles and groups each quarter and remove unused accounts.
6. Login security: enforce two-factor authentication or passkeys and a password policy.
7. Requests: write the Privacy Lookup procedure and test it on a dummy contact.
8. Retention: set recycle rules for leads, applicants and inactive contacts.
9. Website: enable the cookies bar and update the privacy and cookie policy pages.
10. Incidents: define who reports a breach, to whom, within 72 hours.

Want a quick view of where your database stands? Our free Odoo health check tool shows your version, edition, installed apps and whether the version still gets security fixes, in about ten seconds.

Odoo data protection by industry

The GDPR rules are the same for every sector, but the sensitive data and the Odoo apps involved differ. The table shows where we see the most risk.

German and other EU firms often start with hosting. Our Odoo implementation team for Germany works through Odoo DSGVO questions like these during discovery.

How iVentureTeam helps with Odoo GDPR compliance

iVentureTeam turns GDPR requirements into concrete Odoo settings, contracts and procedures. We have delivered 150+ ERP projects across 35+ countries with 40+ Odoo specialists over 13+ years.

• Hosting review: we compare Odoo Online, Odoo.sh and on-premise against your data residency and security needs.
• Access design: roles, groups, record rules, portal access and two-factor authentication set up per team.
• Data flow register: license check, IAP services, AI features and connectors listed with their purpose.
• Privacy procedures: Privacy Lookup, export and retention steps written and tested with your team.
• Ongoing care: our Odoo ERP support team applies security updates and reviews access after each change.

Odoo data protection case study: Enabl Health

A health-tech company gave doctors and patients role-based portals on Odoo.sh after cleaning its legacy data. Enabl Health is in Australia, so this was not a GDPR project, but the access pattern carries over to EU firms.

Enabl Health equips independent health professionals with tools for running their practices. Its doctor and patient portals were not built for mobile, and portal users could not edit timesheets or upload attachments.

We started with a data cleanup across five data sets: sales, timesheets, invoices, payslips and user records. We then built role-based portal views for doctors and patients, with appointment visibility for each role.

The system runs on Odoo.sh with separate staging and production branches. The project took 10 weeks, followed by ongoing support. Read the Enabl Health Odoo portal and billing case study.

The bottom line on Odoo GDPR compliance

Odoo supplies the contract terms, hosting regions and tools, and your company supplies the decisions, settings and proof. Neither side can do the other's part.

Pick the hosting option you can actually secure, confirm where backups sit, lock down access rights, document the license check and other data flows, and test a data subject request before a real one arrives.

Ready to check your Odoo setup against GDPR?

Get a clear list of gaps and fixes for your hosting, access rights and data flows. Request an Odoo data protection review, call +91-90235-15208, or email business@iventureteam.com.