| name | notion-data-handling |
| description | Implement data handling, PII protection, and GDPR/CCPA compliance for Notion
integrations. Use when handling sensitive data from Notion pages, implementing
data redaction, exporting or deleting a user's data on request, or ensuring
compliance with privacy regulations. Trigger with phrases like "notion data",
"notion PII", "notion GDPR", "notion data retention", "notion privacy",
"notion CCPA".
|
| allowed-tools | Read, Write, Edit |
| version | 1.38.0 |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["saas","productivity","notion"] |
| compatibility | Designed for Claude Code |
Notion Data Handling
Overview
Handle sensitive data correctly when integrating with Notion: detect PII in page
properties and text content, redact sensitive fields before logging or exporting,
minimize data exposure with filter_properties, and implement GDPR/CCPA compliance
patterns — right-of-access exports, right-of-deletion (archive or field clearing), and
retention-based archival, all with audit logging.
The full, copy-ready TypeScript and Python implementations live in references/ so this
file stays a navigable map. Read top-to-bottom for the workflow; drill into a reference
file when you need the complete code for a step.
Prerequisites
@notionhq/client v2+ installed (npm install @notionhq/client)- Python alternative:
notion-client (pip install notion-client)
- Understanding of which Notion databases contain personal data
- Audit logging infrastructure (structured logs, SIEM, or Notion audit database)
- Legal guidance on applicable regulations (GDPR, CCPA, HIPAA, etc.)
Authentication
All examples authenticate with an internal integration token read from the environment —
never hardcode it:
const notion = new Client({ auth: process.env.NOTION_TOKEN });
Create the token at notion.so/my-integrations and
share each target database with the integration. Deletion and retention flows additionally
require the integration to hold Update capability, or pages.update returns 403.
Instructions
Work through three stages. Each links to a reference file with the complete implementation.
Step 1 — Detect PII
Notion pages carry PII in dedicated email/phone_number/people properties and
embedded in free-text rich_text/title values. Scan both: check known-sensitive
property types directly, and run regex matchers (email, phone, SSN, credit card, IP) over
text. Loop the whole database through pagination until has_more is false. Skeleton:
function (): [] {
}
