MongoDB

What Is MongoDB?

MongoDB is a NoSQL document database that stores data in flexible, JSON like BSON documents. It is available as open source Community Server for self hosted deployments and as MongoDB Atlas, a fully managed cloud database service running on AWS, Azure, or Google Cloud. MongoDB is widely used for web applications, mobile backends, content management systems, IoT platforms, and real time analytics. Unlike traditional relational databases, MongoDB does not set cookies on end user browsers as it operates at the infrastructure layer. However, the MongoDB Atlas web console and mongodb.com website do set cookies for authentication and analytics.

Data Collected and Storage Approach

MongoDB itself is a data storage engine, meaning the personal data it processes depends entirely on what the application developer chooses to store. Common personal data stored in MongoDB collections includes user profiles, email addresses, transaction records, location data, and application logs. MongoDB Atlas collects operational metadata including connection logs, query performance metrics, cluster configuration data, and user account information for the Atlas console. The Atlas web console sets authentication cookies, session management tokens, and analytics cookies from mongodb.com and cloud.mongodb.com domains.

GDPR and ePrivacy Implications

For self hosted MongoDB Community deployments, the organisation is both controller and processor of all data, with no third party data processing involved. GDPR obligations fall entirely on the deploying organisation. For MongoDB Atlas, MongoDB Inc. acts as a data processor and provides a DPA incorporating SCCs. Atlas holds SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, HIPAA, and PCI DSS certifications. MongoDB Atlas supports configurable data regions, allowing organisations to restrict data storage to EU regions on any of the three supported cloud providers. However, Atlas management plane metadata and some operational data may still be processed in the US. Organisations should configure encryption at rest (enabled by default on Atlas), encryption in transit (TLS), and field level encryption for particularly sensitive data.

Consent and Legal Basis Requirements

MongoDB as a database engine does not directly interact with end users or set browser cookies, so ePrivacy consent requirements do not apply to the database itself. The legal basis for storing personal data in MongoDB depends on the application: typically contract performance (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)). The Atlas web console sets analytics cookies that require consent under the ePrivacy Directive. Organisations building applications on MongoDB must implement their own consent mechanisms at the application layer for any personal data collection, and ensure that the database schema supports data subject rights (access, rectification, erasure, portability).

International Data Transfers

Self hosted MongoDB keeps data wherever the organisation deploys it, with no international transfers unless the organisation configures replication across regions. For Atlas, MongoDB Inc. is US based but offers configurable cluster regions across AWS, Azure, and GCP data centers worldwide, including multiple EU locations (Ireland, Frankfurt, Amsterdam, Paris, Stockholm). Organisations can restrict primary data storage to EU regions. However, Atlas management plane operations, billing data, and support interactions may involve US based systems. Transfers are covered by MongoDB's DPA with SCCs. Organisations should document their chosen Atlas region configuration in their Records of Processing Activities.

Practical Compliance Steps

For Atlas deployments: execute MongoDB's DPA, select an EU cluster region, enable encryption at rest and in transit, configure field level encryption for sensitive fields, implement role based access control (RBAC), enable audit logging, configure network access restrictions (IP allowlists, VPC peering), and review backup data residency settings. For self hosted deployments: enable authentication, configure TLS, enable encryption at rest, implement RBAC, enable audit logging, and secure network access. For all deployments: design your database schema to support GDPR data subject rights (indexing personal data fields for retrieval and deletion), implement data retention policies with TTL indexes or scheduled cleanup processes, conduct a DPIA if storing sensitive personal data at scale, and include MongoDB in your Records of Processing Activities.