GDPR Compliance and Drupal: What European Organizations Need to Know (2026)

The General Data Protection Regulation applies to any website that collects personal data about European citizens — regardless of where in the world the site is hosted. For organizations in the Netherlands, Germany, the UK, Ireland, and across Europe running Drupal, this raises a specific set of questions: what does Drupal do with personal data by default, which contributed modules create compliance risk, and what does an end-of-life Drupal version mean for GDPR obligations?

This guide covers the practical answers, updated for 2026, including the EDPB's new focus on simplifying compliance and what the December 9, 2026 Drupal 10 end-of-life date means for data protection obligations.

What GDPR Actually Requires from Website Operators

GDPR places specific obligations on organizations that process personal data about EU citizens. For a Drupal site, the relevant obligations are:

• Lawful basis: every processing activity needs a legal basis — consent, legitimate interest, contract, or legal obligation. Most analytics and marketing processing requires explicit consent.

• Data minimization: collect only what you actually need. Unused modules that collect data are a compliance risk.

• Security: Article 32 requires technical measures appropriate to the risk. Running unpatched software with known vulnerabilities is a direct GDPR compliance issue, not just a security issue.

• Records of processing: Article 30 requires organizations to maintain records of what personal data they process and how. This includes data processed by third-party modules.

• Cookie consent: the ePrivacy Directive (implemented differently by each EU member state) requires prior consent for non-essential cookies. Pre-ticked boxes are not valid consent.

The European Data Protection Board confirmed in its 2026-2027 work programme that simplifying compliance is a top priority — including ready-to-use templates for organizations. But simplification doesn't reduce the underlying obligations. The fines for non-compliance remain up to 4% of global annual turnover or €20 million, whichever is higher.

What Drupal Does with Personal Data by Default

Drupal core processes personal data in several ways before any contributed modules are installed:

Server logs and IP addresses

Drupal logs IP addresses as part of standard server operation. IP addresses are personal data under GDPR. This processing typically relies on legitimate interest under Article 6(1)(f), but organizations must document it in their Article 30 records of processing activities.

Form submissions

Any contact form, registration form, or comment system collects personal data. The legal basis is usually consent or contract, depending on the purpose. Organizations must have a clear privacy notice explaining what data is collected and why before the form is submitted.

Session cookies

Drupal session cookies and CSRF security tokens are strictly necessary — they allow the site to function and cannot be rejected by visitors. These do not require consent under GDPR's legitimate interest provision. They should be documented in your cookie policy but do not need to be blocked pending consent.

User accounts

If your Drupal site has registered users, their profile data (name, email, roles) is processed under GDPR. Users have the right to access, correct, and delete their data. Drupal 11 includes user data export and deletion capabilities in core that support these rights.

Where GDPR Risk Actually Lives: Contributed Modules

Drupal core by itself has a low GDPR risk profile. The risk changes significantly once contributed modules are installed. The most common sources of compliance risk:

Analytics modules (Google Analytics, Matomo)

Any analytics module that drops tracking cookies requires explicit opt-in consent before the scripts execute. This means the scripts must be blocked until the visitor accepts — not just disclosed in a cookie banner. The technical implementation requires changing script tags from text/javascript to text/plain and using a consent management platform to release them after consent.

The Swedish DPA (IMY) formally warned several organizations in 2025 for using dark patterns in cookie banners — making the accept button prominent while hiding the reject option. The same standard applies across the EU.

Social media and advertising modules

Facebook Pixel, LinkedIn Insight Tag, TikTok Pixel, and similar modules transfer data to third countries (primarily the US) and require explicit consent. These transfers must be documented and covered by appropriate safeguards under GDPR Chapter V.

Webform and contact modules

Webform handlers that send data to third-party CRMs, email marketing platforms, or other services require documentation of the data transfer and, usually, explicit consent from the person submitting the form.

Video embeds (YouTube, Vimeo)

Embedded video players from external platforms set tracking cookies on load. These require consent before the embed executes. The standard approach is to replace the embed with a preview image until consent is given, then load the actual player.

EU Cookie Compliance module

The EU Cookie Compliance module (70,020 active installs as of 2026) is the most widely used GDPR cookie consent implementation for Drupal. It blocks non-essential cookies pending consent and provides a configurable banner. However, it does not automatically detect which cookies your site drops — you need to audit your contributed modules and configure the blocking rules manually.

What an Unsupported Drupal Version Means for GDPR

This is the part most GDPR guides for Drupal sites skip, and it's the most consequential for organizations currently on Drupal 7, 8, 9, or 10.

GDPR Article 32 requires organizations to implement appropriate technical measures to ensure security appropriate to the risk — including protection against unauthorized access to personal data. Running software with known, unpatched security vulnerabilities is a failure of this obligation.

Drupal 7, 8, and 9: no patches, permanently exposed

Drupal 7 reached end of life January 5, 2025. Drupal 8 reached end of life November 2021. Drupal 9 reached end of life November 2023. Every security vulnerability found in these versions after their EOL dates is permanently unpatched. No fix is coming.

For a site processing personal data about EU citizens — contact forms, user registrations, analytics — running on an unsupported version with unpatched vulnerabilities is a direct GDPR Article 32 compliance issue. Data protection authorities have taken enforcement action against organizations for exactly this pattern.

Drupal 10: end of life December 9, 2026

Drupal 10 reaches end of life December 9, 2026. After that date, no security patches will be issued for Drupal 10 core or contributed modules. Organizations currently on Drupal 10 have until December 9 to migrate to Drupal 11, or they face the same compliance exposure as sites on Drupal 7, 8, and 9.

For organizations subject to GDPR — which includes any organization processing data about EU citizens, regardless of where the organization is based — this is not just a security decision. It's a compliance deadline.

GDPR Modules for Drupal — What's Available

EU Cookie Compliance

Works with Drupal 8, 9, 10, and 11. Handles cookie consent banner display, blocks non-essential cookies pending consent, and provides configurable categories. 70,020 active installs. Stable and maintained.

GDPR module

Provides basic GDPR compliance tools including form checkboxes for consent, policy pages, and user registration/login consent flows. Primarily for Drupal 8. Organizations on Drupal 11 should evaluate whether a more current solution better fits their stack.

Right to be Forgotten

Provides a mechanism for users to request deletion of their personal data from the site, supporting GDPR Article 17 rights.

Data Policy

Allows site administrators to require users to agree to a data policy before accessing the site, with version tracking so users are prompted to re-agree when the policy changes.

GDPR Compliance Checklist for Drupal Sites

• Document all personal data processing in your Article 30 records — including what each contributed module sends where

• Audit all installed modules for third-party data transfers (analytics, advertising, social embeds, CRM integrations)

• Implement a consent management platform that blocks non-essential scripts until consent is given

• Ensure cookie banner defaults are opt-in, not opt-out. Pre-ticked boxes are not valid consent

• Avoid dark patterns: reject option must be as prominent as accept

• Configure EU Cookie Compliance module with correct categories: strictly necessary, functional, analytics, marketing

• Add privacy notice to all forms collecting personal data

• Implement user data export and deletion for sites with registered users

• Document any third-country data transfers and their legal basis (standard contractual clauses, adequacy decisions)

• Ensure your Drupal version is supported and actively patched — unpatched vulnerabilities are an Article 32 compliance failure

• If on Drupal 7, 8, 9, or 10: assess GDPR risk exposure from unsupported software and plan migration

Common Questions — Answered Directly

Is Drupal GDPR compliant?

Drupal core is GDPR-neutral by design — it processes IP addresses and form data but drops no tracking or marketing cookies by default. GDPR compliance depends on how the site is configured and which contributed modules are installed. A Drupal site running only core with no analytics or marketing modules has a low GDPR risk profile. A Drupal site with Google Analytics, Facebook Pixel, and CRM integrations requires explicit opt-in consent management before those modules execute.

What Drupal modules are needed for GDPR compliance?

The most widely used module is EU Cookie Compliance (70,020 active installs), which handles cookie consent banners and blocks non-essential scripts pending consent. The GDPR module provides consent checkboxes for forms and policy pages. The Right to be Forgotten module supports user data deletion requests. For multilingual sites, ensure your consent management covers all language versions.

Does GDPR apply to my Drupal site if I'm not in the EU?

Yes. GDPR applies to any organization that processes personal data about EU citizens, regardless of where the organization or its servers are located. If your Drupal site collects contact form submissions, analytics data, or user registrations from visitors in EU member states, GDPR applies to that processing.

What happens to GDPR compliance if my Drupal version is end of life?

Running an end-of-life Drupal version with unpatched vulnerabilities is a direct GDPR Article 32 compliance failure. Article 32 requires appropriate technical measures to protect personal data, including against unauthorized access. Known, unpatched security vulnerabilities are exactly the risk Article 32 addresses. Data protection authorities have taken enforcement action against organizations running vulnerable software that exposed personal data.

What is the GDPR fine for running an insecure website?

GDPR fines under Article 83 can reach €10 million or 2% of global annual turnover for Article 32 (security) violations, whichever is higher. For more serious violations involving fundamental principles of data processing, fines can reach €20 million or 4% of global annual turnover. The actual fine depends on factors including the nature of the violation, the number of individuals affected, and whether the organization took action to mitigate the damage.

Does Drupal 11 make GDPR compliance easier?

Yes, in several ways. Drupal 11 includes user data export and deletion capabilities in core, supporting GDPR Article 17 and 20 rights without additional modules. It receives regular security patches, ensuring Article 32 obligations can be met. The EU Cookie Compliance module is fully compatible with Drupal 11. Organizations migrating from older Drupal versions to 11 should audit their contributed modules for GDPR compliance as part of the migration process.

What is the Drupal 10 end-of-life date and what does it mean for GDPR?

Drupal 10 reaches end of life December 9, 2026. After that date, no security patches will be issued for Drupal 10 core or contributed modules. For organizations processing personal data about EU citizens, running Drupal 10 after December 9, 2026 on an unpatched codebase creates GDPR Article 32 compliance exposure. The practical implication: organizations on Drupal 10 should complete migration to Drupal 11 before December 9, 2026.

Drupalify is listed on DesignRush as a verified Drupal development company.

Get your free audit → drupalify.com/contact