Payload CMS

What Is Payload CMS?

Payload is an open source, code-first headless CMS and application framework built with TypeScript, Node.js, and React. Unlike traditional SaaS CMS platforms, Payload is fully self-hosted, meaning the website operator deploys and controls the entire application and database. Payload provides a powerful admin panel, REST and GraphQL APIs, authentication, access control, file uploads, and rich text editing out of the box. It supports MongoDB and PostgreSQL as database backends and can be deployed on any hosting provider or cloud infrastructure.

Cookies and Data Collected by Payload CMS

Payload CMS sets a single cookie by default: payload-token, an HTTP-only cookie that stores a JSON Web Token (JWT) for authentication. This cookie is used exclusively for admin panel access and application-level authentication. It is classified as strictly necessary and does not track visitor behaviour, store marketing data, or enable profiling. The cookie name prefix can be customised via the Payload configuration. Payload also collects optional, completely anonymous telemetry data about general CMS usage, which can be disabled by the operator. No analytics, advertising, or third-party tracking cookies are set by the CMS framework itself.

GDPR and ePrivacy Implications

Payload CMS has a minimal privacy footprint. The payload-token cookie qualifies as strictly necessary under the ePrivacy Directive (Article 5(3)) because it is essential for the admin panel to function, and therefore does not require user consent. Since Payload is self-hosted, no personal data is transmitted to Payload CMS, Inc. or any third party by default. The GDPR applies to the personal data stored in the CMS collections (content, user accounts, form submissions), but the responsibility lies with the website operator as data controller. Payload CMS, Inc. is a US-based company, but in a self-hosted deployment, the company has no access to the operator's data. If using Payload Cloud (managed hosting), a DPA with SCCs would be required for EU data processing.

Consent and Legal Basis Requirements

No cookie consent banner is required for Payload CMS itself, as the payload-token is a strictly necessary authentication cookie exempt from consent requirements. However, website operators must ensure that any additional services integrated into their Payload-powered website (analytics, marketing pixels, embedded content, social media widgets) have their own consent mechanisms in place. For the personal data stored in CMS collections, the website operator must determine the appropriate GDPR legal basis (typically contractual necessity for user accounts, consent for marketing communications, or legitimate interest for content management). Payload provides robust access control at the collection and field level, supporting the principle of data minimisation.

Data Transfers and Data Sovereignty

One of Payload CMS's strongest privacy advantages is complete data sovereignty. In a self-hosted deployment, all data (content, user accounts, media files) remains on the operator's own servers, in any jurisdiction of their choosing. No data flows to Payload CMS, Inc. unless optional telemetry is enabled (which sends only anonymous, non-personal usage statistics). For Payload Cloud users, data is hosted on US infrastructure, requiring Standard Contractual Clauses (SCCs) for processing EU personal data. The self-hosted model eliminates concerns about international data transfers, sub-processors, and third-party data access.

Practical Compliance Steps

To ensure GDPR compliance with Payload CMS: deploy on EU-based infrastructure if processing EU personal data. Disable optional telemetry if you want zero data sent to Payload CMS, Inc. Configure access control at the collection and field level to enforce data minimisation. Implement data retention policies for CMS collections containing personal data. Set up CSRF protection by whitelisting your trusted domains. Update your privacy policy to disclose the payload-token authentication cookie (strictly necessary, no consent required). If integrating third-party services (analytics, forms, payment), implement a CMP for those services separately. Document your CMS data processing in your Record of Processing Activities (ROPA). Enable SSL/HTTPS and configure the payload-token cookie with secure: true and sameSite settings appropriate for your deployment.