Cloudflare set up to meet the GDPR
Your website is protected, and you answer every privacy question with a finished document. I set up Cloudflare so your data protection officer can sign off.
Works with your website on
Signs your privacy setup around Cloudflare has gaps
These questions come up almost every time Cloudflare runs in front of a website.
Your data protection officer asks whether there's a data processing agreement with Cloudflare.
Your privacy policy doesn't mention Cloudflare, even though it runs in front of your website.
Nobody knows which cookies Cloudflare sets or whether they need a banner.
Google Analytics starts before anyone has accepted the cookie banner.
Your data protection officer gets everything they want to check
Cloudflare only learns the bare minimum about your visitors: IP address, page requested, browser. For every question about it, you get a document.
Cloudflare includes its data processing agreement in its terms, on the free plan too. I file the current version for your record of processing activities.
- Data processing agreementon file
- Record of processingentered
- Separate negotiation neededno
More that Cloudflare handles for your website
It all runs in the same Cloudflare account. Whatever you set up today can be extended later.
- ViewCloudflare ZarazTracking through your own domain, only after consent.
- ViewDDoS protectionYour website stays online during overload attacks.
- ViewCloudflare WAFAttacks and password guessing stay away from your server.
- ViewCloudflare TurnstileReal inquiries instead of spam, without picture puzzles.
- ViewCloudflare WorkersSmall jobs run at Cloudflare, without a server.
I'll also tell you when Cloudflare isn't enough
Data must never leave the EU
For that, Cloudflare offers the Data Localization Suite. It's Enterprise-only, so a separate contract at a much higher cost. For clinics, public bodies or law firms it can be worth it.
Your data protection officer rules out US providers
Then I'll recommend a European provider for protection and delivery. I'll tell you in the first call, before you spend money.
I'm not a lawyer. The legal sign-off comes from your data protection officer.
How the setup works
At the end you have every document in one folder.
- 01Intro callIn 30 minutes we look at which services run on your website and what your data protection officer requires.
- 02Fixed-price quoteYou get in writing what I set up and which documents you'll have afterwards.
- 03Setup and documentsI set up Cloudflare and hand you the agreement, privacy policy text and cookie list in one folder.
Fixed price after the intro call
Cloudflare itself is free for most company websites. You get scope, price and documents in writing before I start.
Questions about Cloudflare and privacy
Christian Schmitt answersCloudflare can be used in a GDPR-compliant way. You need the data processing agreement, a safeguarded transfer to the US, an entry in your privacy policy and consent before tracking services get data. Whether that's enough for your company is up to your data protection officer.
Christian Schmitt answersYes, because Cloudflare processes your visitors' IP addresses on your behalf. You don't have to negotiate it: Cloudflare includes it in its terms, on the free plan too. I file the current version with your documents.
Christian Schmitt answersCloudflare is certified under the EU-U.S. Data Privacy Framework. The EU Standard Contractual Clauses apply as a fallback. Both are part of the agreement.
Christian Schmitt answersYes. It should say that Cloudflare acts as a processor, which data is involved, that data may go to the US and on what legal basis. For protection and delivery that's usually legitimate interest under Article 6(1)(f) GDPR. Your data protection officer reviews and approves the text.
Christian Schmitt answersFor protection, usually not. Cloudflare sets the __cf_bm cookie for bot protection, for example, and classes its cookies as strictly necessary. You should still list them in your privacy policy. You need a banner as soon as analytics or ad pixels run.
Christian Schmitt answersManaging your domain's DNS at Cloudflare involves very little personal data, because queries mostly come from internet providers' DNS servers rather than from your visitors. It's covered by the same agreement.
Christian Schmitt answersCloudflare is a US company, so US authorities can request data. For most company websites the risk is considered low, because Cloudflare holds little more than IP addresses and log data. If your website processes health or client data, discuss it with your data protection officer.
