GDPR compliant scheduling, with the paperwork
Every booking is personal data. Cal.com, Inc. processes it for you under a Data Processing Agreement, sends it to the USA under the EU-U.S. Data Privacy Framework, and keeps it in the European Union on Cal.eu. This page shows the document behind each step, and why each one matters for the scheduling you run on Cal.com.
Last reviewed on 6 November 2026. This page is information, not legal advice.
Trusted by fast-growing companies around the world
Three facts your data protection officer can check
The GDPR is a law, not a badge. What counts is a contract with every processor, a lawful route for transfers and appropriate security. Each has a document.
01
A Data Processing Agreement
Our Data Processing Agreement is the contract Article 28 GDPR asks for between you and a processor, with the standard contractual clauses attached.
02
A lawful route to the USA
Cal.com is hosted in the USA, and Cal.com, Inc. is on the Data Privacy Framework List. Since 10 July 2023, that makes the transfer lawful under Article 45 GDPR.
03
Or no transfer at all
Cal.eu is the same app, hosted in the European Union, for organizations whose contracts or policies require data residency.
Why the GDPR matters when you run your scheduling on Cal.com
A scheduling tool collects personal data from people who are not your users yet. You answer for it.
01
Every booking is personal data
A name, an email address and a time are enough. Booking questions, notes and attendee lists add more, and in some fields that data is sensitive.
02
You are the controller
You decide why bookings are taken, so the GDPR's duties are yours. Cal.com processes the data on your behalf, and the DPA puts that relationship in writing.
03
Data crosses the Atlantic
Cal.com runs in the USA. The transfer rests on the adequacy decision for the Data Privacy Framework; the DPA's standard contractual clauses stand behind it. Read the details.
04
Security is part of the law
Article 32 GDPR asks for appropriate technical and organisational measures. Our SOC 2 Type II report and ISO/IEC 27001 certificate are the evidence, flawless in every audit since 2022.
Cal.com with the DPF, or Cal.eu hosted in Europe
Both are lawful under the GDPR, and both are the same product. Cal.eu answers a different question: where the data sits.
| Feature | Cal.com with the DPF | Cal.eu, hosted in Europe |
|---|---|---|
| Data | ||
| Where data is stored and processed | United States | European Union |
| Basis for sending data to the USA | Article 45 GDPR: adequacy decision for the EU-U.S. Data Privacy Framework | None needed: the data stays in the EU |
| Second transfer tool | Standard contractual clauses in the DPA | Not needed for hosting in the EU |
| Compliance | ||
| GDPR, SOC 2 Type II, ISO 27001 | ||
| Product | The full Cal.com app | The same app |
What to do before your review
Three steps that take an afternoon and answer most data protection reviews.
01
Read the DPA
Read the DPA and the standard contractual clauses schedule, and file them with your records of processing activities.
02
Check the DPF entry
Open Cal.com, Inc.'s entry on the Data Privacy Framework List. Note the status and the date: that is your proof under Article 5(2) GDPR.
03
Tell your attendees
Name Cal.com as a processor in your privacy notice. Our privacy policy covers the data we handle for our own account.
The rest of Cal.com's compliance
Each framework answers a different question. Together they cover the security of the service, the laws on the data in it, and where that data may go.
01
SOC 2 Type II
An independent auditor tests our security, availability and confidentiality controls over months, every year. Read about SOC 2.
02
ISO/IEC 27001
Our information security management system is certified to the international standard and audited to keep the certificate. Read about ISO/IEC 27001.
03
HIPAA
For healthcare teams handling protected health information: a signed business associate agreement and the safeguards behind it. Read about HIPAA.
04
EU-U.S. Data Privacy Framework
Cal.com, Inc. is an active participant, with the UK Extension. See the entry or read why it matters.
Frequently asked questions about the GDPR
The short ones are here. For anything else, ask below.
Ask a questionYes. Cal.com processes personal data under a Data Processing Agreement with standard contractual clauses, transfers it to the USA under the EU-U.S. Data Privacy Framework, and is SOC 2 Type II and ISO/IEC 27001 certified. Cal.eu keeps data in the EU.
For the bookings you take, Cal.com, Inc. is your processor under the DPA. For its own accounts and website it is a controller, as its privacy policy explains.
On Cal.com, in the United States. On Cal.eu, in the European Union.
Not for the transfer itself: the adequacy decision for the Data Privacy Framework is enough for companies on the list. The DPA already includes the standard contractual clauses as a second transfer tool.
Yes. Under the GDPR, the people who book with you can ask for access, correction and deletion. You answer them as the controller; under section 7 of the DPA, Cal.com assists you as your processor.
Read the originals
Everything above comes from these documents. Only the last three are ours.
- Regulation (EU) 2016/679, the General Data Protection Regulation: Article 28 on processors, Article 32 on security, Chapter V on transfers.
- Commission Implementing Decision (EU) 2023/1795 of 10 July 2023: the adequacy decision for the EU-U.S. Data Privacy Framework.
- Cal.com, Inc. on the Data Privacy Framework List, U.S. Department of Commerce: the public entry, EU-U.S. DPF and UK Extension.
- Data Processing Agreement and its standard contractual clauses schedule, Cal.com: the contract for the data we process for you.
- Privacy policy, Cal.com: the data we handle for our own account and the rights you have over it.
- Security at Cal.com: our controls, penetration testing and vulnerability disclosure.
Scheduling your data protection officer can sign off
A DPA, a lawful transfer and audited security for Cal.com. Cal.eu for organizations that keep their data in the European Union.
Get startedSee Cal.eu