Yes, a Notion form is safe for everyday personal data such as names, emails and phone numbers, as long as you control who can open the database behind it. Notion encrypts the data and offers a GDPR data processing addendum. Health data and other sensitive categories are different: keep them out unless you’re on the Enterprise plan with a signed agreement and a legal basis.
Is personal data in a Notion form secure?
Personal data collected through a Notion form gets the same protection as everything else in your workspace. Notion’s HIPAA help page says customer data “is encrypted at rest using AES-256”, and data in transit uses TLS 1.2 or greater.
The same page says Notion keeps database backups that can restore a snapshot of your content from the past 30 days. Enterprise workspace owners also get an audit log, which matters if you ever need to show who looked at what.
Encryption isn’t the weak spot. Sharing is.
Who can see the responses to your Notion form
Responses to a Notion form are visible to anyone with at least Can view access to the connected database. Notion’s forms help page says so directly. The form is only as private as the database.
Say you build a job application form inside a teamspace your whole company can view. Every applicant’s email, phone number and CV link is now readable by every member of that teamspace. Nothing about the form warns you.
Before you publish, check three things:
- Open the database’s Share menu and remove groups that don’t need the responses.
- If the database sits in a broad teamspace, move it to a private page.
- On Enterprise, admins can block public forms entirely with Disable publishing sites, forms, and public links under Settings, Security.
Who can fill it out, and whether names are recorded
Notion forms let you choose who can fill them out and whether respondent names are stored. Under Who can fill out, the options are anyone in your workspace with the link, anyone on the web with the link, or no access.
By default, Notion creates a Respondent property to capture respondents’ names. You can turn on Anonymous responses in the sharing settings. The help page adds that forms open to “Anyone on the web with link” are automatically anonymous, so a public form won’t attach a Notion identity to the row.
Anonymous only covers the account name. Respondents can still type their own details into the questions.
For more on public sharing, see how to share a Notion form publicly.
What the GDPR expects when you collect personal data
Under the GDPR, you are the one collecting the data, so you carry the duty to justify it. Article 5 says personal data must be “adequate, relevant and limited to what is necessary”, and that the controller must be able to demonstrate compliance.
Article 28 says you may only use processors “providing sufficient guarantees”, with the processing governed by a contract. Notion covers this with its Data Processing Addendum. Its GDPR page says the DPA applies to the extent Notion processes personal data subject to the GDPR on your behalf.
Two other details from that page:
- Transfers out of the EU rely on standard contractual clauses (SCCs).
- Notion publishes a list of its subprocessors, which you can name in your own privacy notice.
In practice, that means a short privacy note on the form, a clear purpose, and no “just in case” questions.
Data to keep out of a Notion form
Some personal data needs far more than a form and a shared database. Article 9 of the GDPR says processing data about health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation “shall be prohibited” unless an exception applies, such as explicit consent.
Health data has a second hurdle in the US. Notion says that to sign its BAA (Business Associate Agreement) “you must subscribe to our Enterprise Plan”. Even then, protected health information can’t go in workspace names, teamspace names, file names, user profiles or user group names, and Notion “may not be used to communicate with patients”.
| Field | Fine on most plans? | Why |
|---|---|---|
| Name, email, phone | Yes | Ordinary contact data, if you restrict database access |
| Company, job title, budget | Yes | Business data with a clear purpose |
| Date of birth, home address | With care | Ask only if the purpose needs it (Art. 5) |
| Health, symptoms, diagnoses | No, unless Enterprise + BAA | Art. 9 special category and HIPAA rules |
| Religion, ethnicity, sexuality | Avoid | Art. 9 special category |
| Passwords, card numbers | Never | Not what a form-to-database tool is for |
My take: if a question would make you nervous to see in a screenshot of your database, don’t ask it. Most intake forms work fine without date of birth or a home address, and dropping them removes the risk entirely.
If you use a third-party form that writes to Notion
A third-party form builder adds one more company that handles your respondents’ data. Check what it stores, where, and for how long, and name it in your privacy notice alongside Notion.
As an example, nDBForms only asks for access to the databases you choose. Each submission is written to Notion, and a copy is kept in nDBForms’ own database (Cloudflare D1) for the dashboard and for retrying failed writes. That copy is a real limitation if you want the data in one place only. Deleting the form deletes its stored responses.
Worth reading next: the limits of native Notion forms and whether respondents need a Notion account. For uploads like CVs, see file uploads in Notion forms.
FAQ
Is Notion encrypted?
Yes. Notion says customer data is encrypted at rest using AES-256, and data in transit uses TLS 1.2 or greater.
Can I collect health information with a Notion form?
Only with care. Notion’s BAA requires the Enterprise Plan, and under the GDPR health data is a special category that needs a legal exception such as explicit consent.
Who can see the responses to my Notion form?
Anyone with at least Can view access to the database the form is connected to. Check the database’s sharing before you publish the form.
Does a Notion form record who filled it in?
It can. A Respondent property captures names by default, but you can turn on Anonymous responses, and forms shared with anyone on the web are anonymous automatically.