Analytics, BI and data platforms

• Regulation (EU) 2016/679 — GDPR, Articles 27 and 28
• Directive 2002/58/EC — ePrivacy for device access
• Regulation (EU) 2023/2854 — Data Act for cloud switching

Who has to appoint one

Providers outside the Union offering analytics or data platform services to EU customers. Where the platform only processes what the customer sends, the vendor is a processor; where it enriches, benchmarks or trains on customer data, it becomes a controller for those purposes.

Thresholds and exemptions

No threshold. Product analytics embedded in a customer's application reads and writes on end users' devices, which brings the ePrivacy consent requirement independently of the GDPR analysis.

What must appear on the label

Not physical. The representative's identity in the privacy notice and in the customer-facing processing terms, and a clear statement of what the vendor does with customer data for its own purposes.

Marketplace fields

EU enterprise buyers require the Article 28 terms, the subprocessor list, the transfer analysis and, since the Data Act, contractual terms on switching and data portability. Public sector buyers require more.

Documentation you must hold

Article 30(2) processor records, processing agreements with each customer and subprocessor, the Article 27 designation, standard contractual clauses with transfer impact assessments, retention and deletion procedures, and the Data Act switching terms.

Standards and testing

Not applicable, though customers exercise audit rights and expect certifications such as ISO 27001 or SOC 2 as supporting evidence rather than as compliance.

Language requirements

Customer documentation in the language of the market; end-user notices in the language of the users.

When it applies

The representative before processing begins. Data Act switching provisions phased from September 2025, with egress charges withdrawn from January 2027.

How long records are kept

Customer data only for the contracted period plus the agreed deletion window, with verified deletion on exit.

What happens if you do not comply

Up to €20 million or 4% of turnover for unlawful processing, and €10 million or 2% for the missing representative. Using customer data to train models without a basis is the recurring structural failure in this sector.

Who enforces it

Data protection authorities across the Union, and national authorities designated for the Data Act.

Where the boundary lies

Aggregation does not automatically anonymise: benchmark datasets built from customer data frequently remain personal data, and using them for the vendor's own purposes needs its own basis and transparency, not merely a contract clause.

Questions we are asked

Can we use customer data for benchmarks?

Only with a lawful basis of your own and transparency to the individuals concerned. A permission in the customer contract does not settle it.

Is IP address collection processing?

Yes. IP addresses are personal data in the hands of a service that can link them to a user, which the Court of Justice has confirmed.