BambooHR and the GDPR: AI training, data location and DPA

Trains on your data, with no documented way to stop it.

Yes, for the customer's own AI model only: BambooHR may use your data, inputs and outputs to fine-tune and train the models behind its AI features, but says it will do so just to provide those features to you and will not use that model for other customers.

Vendor's wording: “To the extent that BambooHR uses customer Data, Input and Output to fine-tune and train the machine learning methods and data models used to provide the Bamboo AI features, it will do so just to provide the Bamboo AI features to you”

Source: bamboohr.com8. Improving Bamboo AIChecked on 19 October 2026

United States, Canada or Ireland, depending on the individual customer's location and needs and applicable laws; no default named.

Vendor's wording: “We host customer data in state-of-the-art data centers located in the United States, Canada, or Ireland, depending on the location and needs of the individual customer and applicable laws.”

Source: bamboohr.comSecure, International Hosting SitesChecked on 19 October 2026

EU hosting not documented.

Partly: an Ireland data centre is offered that BambooHR says meets EU/EEA/Swiss/UK data requirements, assigned depending on the customer's location and needs. No self-serve setting is described.

Vendor's wording: “the data center located in Ireland meets all of the data requirements of the European Union, European Economic Area, Switzerland, and the United Kingdom”

Source: bamboohr.comSecure, International Hosting SitesChecked on 19 October 2026

DPA in the terms.

Yes. A Data Processing Agreement is published online and is incorporated into the Terms of Service 'if applicable and accepted by you'; it includes EU Standard Contractual Clauses.

Vendor's wording: “the Data Processing Agreement (DPA) (if applicable and accepted by you), are incorporated herein by reference”

Source: bamboohr.com6.6 PrivacyChecked on 19 October 2026

On the list.

Active (Bamboo HR LLC; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Bamboo HR'Checked on 19 October 2026

After a subscription ends you can download your data for 30 days, then BambooHR deletes it; payroll-service data is kept 7 years for legal and tax reasons. Retention during the subscription is not stated.

Vendor's wording: “you will continue to have the ability to download the information provided, inputted, or uploaded to your databases in the BambooHR® Service by you or on your behalf (“Customer Data”) for thirty (30) days after the effective date of expiration or termination”

Source: bamboohr.com2.5 Customer Data Downloads and DeletionChecked on 19 October 2026

Names an annual third-party SOC 1 and SOC 2 audit (SOC 2 Type 2 report in the trust centre, under NDA); no ISO certification named on the security page (2 named).

Vendor's wording: “Annual third-party SOC I & II security audit.”

Source: bamboohr.comSecurityChecked on 19 October 2026