The GDPR Analytics Checklist: 12 Questions Your DPO Will Ask

When your Data Protection Officer reviews your analytics setup, they will ask specific questions. Here is what they want to know, and how to answer.

The 12 Questions

1. Does the analytics tool set cookies?

If yes, you need explicit consent before tracking. If no, you can track all visitors without a consent banner.

Ideal answer: No cookies are set. Tracking works without any client-side storage.

2. Is personal data collected?

Under GDPR, IP addresses, device fingerprints, and persistent identifiers are personal data.

Ideal answer: No personal data is collected. IP addresses are anonymized immediately during processing and never stored.

3. Where is the data processed?

Data transfers outside the EU require additional legal safeguards under Schrems II.

Ideal answer: All data is processed and stored exclusively within the EU, on EU-operated infrastructure.

4. What is the legal basis for processing?

You need either consent, legitimate interest, or to demonstrate that no personal data is processed.

Ideal answer: No personal data is processed, so no legal basis is required. Alternatively, legitimate interest applies for anonymized analytics.

5. Is there a data processing agreement (DPA)?

If a third-party processes data on your behalf, you need a DPA.

Ideal answer: A DPA is in place with the analytics provider, covering all Article 28 GDPR requirements.

6. How long is data retained?

Data should not be kept longer than necessary for its stated purpose.

Ideal answer: Aggregated analytics data is retained for the subscription period. No raw personal data is stored at any point.

7. Can individual visitors be identified?

Cross-referencing analytics data with other sources should not enable re-identification.

Ideal answer: No. Daily-rotating anonymization makes re-identification technically impossible.

8. Are subprocessors used?

All parties in the data processing chain must be GDPR compliant.

Ideal answer: All subprocessors are EU-based and listed in the analytics provider's subprocessor register.

9. Is data shared with third parties?

Analytics data should not be shared beyond the data controller and processor.

Ideal answer: No data is shared with any third party. Analytics data is exclusively available to the site owner.

10. What happens if there is a data breach?

You need incident response procedures for any personal data breach.

Ideal answer: Since no personal data is stored, a data breach of analytics data does not trigger GDPR notification requirements.

11. Can data subjects exercise their rights?

Visitors must be able to access, rectify, and delete their personal data.

Ideal answer: Since no personal data is collected, data subject access requests are not applicable. This is documented in the privacy policy.

12. Is a Data Protection Impact Assessment (DPIA) required?

High-risk processing activities may require a DPIA.

Ideal answer: A DPIA is not required because the analytics tool does not process personal data or engage in profiling, tracking, or automated decision-making.

The Simple Solution

Notice a pattern? When your analytics tool does not collect personal data, most GDPR requirements become non-issues. This is the core advantage of privacy-first analytics: compliance by design, not by configuration.