Is it safe to send ID numbers from Make.com to Airtable?

How To
,
1

Hi everyone,

I’m working on a workflow in Make.com that involves sending personal data to Airtable. Specifically, I’m considering sending ID numbers (like national ID numbers or similar sensitive identifiers).

I want to make sure that this is handled securely and in compliance with privacy regulations (like GDPR).

  • Is it safe to send such sensitive data directly through Make.com to Airtable?

  • Should I encrypt these values before sending them?

  • Are there any recommended best practices for handling highly sensitive personal information in Make workflows?

Any guidance or advice would be greatly appreciated.

Thanks in advance!

3

Hi @Magdalena_Osetek,

Welcome to the Make community! This is not in compliance with GDPR. National ID numbers are significantly more sensitive than phone numbers or emails. Under GDPR:

  • Email/phone: Regular personal data
  • National IDs: Special category data requiring higher protection levels:
    • Often subject to additional national regulations
    • In EU countries, collecting/processing these requires explicit legal basis
    • Misuse carries heavier penalties

Data can be stored in the EEA for Make, but Airtable is only available in EU regions for Enterprise customers I believe. Even then, we are talking about Data Residency that is not GDPR conform (not fully) because of the CLOUD act. The Clarifying Lawful Overseas Use of Data (CLOUD) Act (2018) allows US authorities to demand data from US companies regardless of where that data is stored. This creates a fundamental conflict with GDPR:

  • Airtable = US company (San Francisco)
  • Make.com = Czech company (EU-based)
  • US authorities could potentially request your Airtable data, including those national IDs

Also, consider these risks:

  • Data is visible in Make scenario logs (by default, can be turned off)
  • Both platforms store data (potentially unencrypted at rest)
  • Multiple third-party dependencies increase attack surface
  • Airtable isn’t specifically designed for highly sensitive data

GDPR is serious business, although there is some gray area, you really want to be careful. Talk to an expert for guidance.

(I shared some facts, this is not legal advice)

Cheers,
Henk