If I have statistics on users location data (i.e. city, country, etc.) aggregated from hundreds or thousands of users, are there any restrictions on storing and using these data under GDPR? I plan to store it in plain text and make it publicly available, with the users' consent of course. E.g. 1540 users from country X have an average statistics of Y. Of course if one user's data is deleted, it will still remain a part of the aggregate statistics. Will this be legal under GDPR?

  • 1
    It depends on whether reidentification, be means of the mosaic effect or other means, is possible. If reidentification is not possible, this is not personal data as defined in the GDPR. May 26, 2018 at 14:11

1 Answer 1


You will need consent that is freely given, informed, unbundled and intelligible. This is a high burden. Without consent you will have to encrypt/anonymise personal data before you aggregate and run data analytics. If you rely on a de-identification or pseudomization method, you are not exempt from privacy law. As for deletion of user data, as long as you have anonymised the data prior to aggregation, it is okay under the GDPR - specifically the right of erasure. You wouldn't have to remove it from aggregate statistics because it isn't technically feasible.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .