Handling a GDPR subject access request when using google analytics?
<p>When using Google Analytics and receiving a GDPR subject access request does the party receiving the request also have to send all data collected by Google Analytics?</p>

<p>Yes, it would be too obvious a loophole otherwise. You'd just put a shell company in front of the actual business, and have that shell company claim it didn't hold onto any data.</p>

<p>Formally, you are the Data Controller, and Google is a Data Processor. You must have a contract in place with Google that guarantees you can abide by GDPR obligations.</p>

<p>Just to add to the (correct) answer already given by @MSalters.</p>

<p>You can escape this obligation by <em>not</em> letting Google Analytics process personal data on your behalf.</p>

<p>You can do this by enabling the GA <a href="https://developers.google.com/analytics/devguides/collection/analyticsjs/ip-anonymization" rel="nofollow noreferrer">IP-anonymization</a> feature.</p>

<p>If you use Google Analytics and <em>do</em> not use this feature, you need to have a DPA (Data Processing Addendum) contract in place with Google in order to comply with the GDPR.</p>

<p>This is a real hassle, so unless you absolutely need fine-grained demographic data, it is strongly recommended that you use IP-anonymization.  According to our data protection supervisory authority, this is sufficient to comply with the GDPR vis-a-vis Google Analytics.</p>

privacy international european-union gdpr regulations