Do we need a Data Processing Agreement with Metabase to comply with GDPR?

If you self-host your Metabase instance, we have no access to any of your data, and only collect anonymized usage stats if you opted-in during installation. Even in that case, we do not gather any personally-identifiable data. As such, if you are self-hosting, we are not a data processor for the purposes of GDPR.

If you are a Metabase Cloud customer, your Terms of Service include a Data Processing Agreement (DPA).