[{"data":1,"prerenderedAt":355},["ShallowReactive",2],{"locale-alternates:\u002Fgdpr-customer-data-analytics-purpose-access":3,"post-\u002Fgdpr-customer-data-analytics-purpose-access":7},{"path":4,"alternates":5},"\u002Fgdpr-customer-data-analytics-purpose-access",{"en":4,"de":6},"\u002Fde\u002Fdsgvo-kundendaten-analysieren",{"page":8,"translations":203,"nav":207,"related":331,"random":344},{"id":9,"title":10,"body":11,"categories":175,"category":177,"changeHistory":177,"date":178,"description":179,"disclosures":180,"draft":183,"extension":184,"firstLiveAt":177,"image":185,"imageAlt":186,"kind":187,"lang":188,"meta":189,"navigation":190,"omitGermanLocalizationDisclosure":183,"path":4,"publishedAt":177,"readingTime":191,"rights":177,"seo":192,"seoTitle":193,"slug":194,"sources":177,"stem":194,"tags":195,"translationKey":200,"type":201,"updated":177,"__hash__":202},"posts\u002Fgdpr-customer-data-analytics-purpose-access.md","GDPR and Customer Analytics: Can You Reuse the Data You Already Hold?",{"type":12,"value":13,"toc":165},"minimark",[14,25,28,31,34,37,42,45,58,61,64,67,71,74,77,86,89,93,96,99,102,111,114,118,121,130,133,136,140,143,146,149,152,155,159,162],[15,16,17],"blockquote",{},[18,19,20,24],"p",{},[21,22,23],"strong",{},"TL;DR:"," Holding customer data does not give a business unrestricted permission to analyse it. Under GDPR, a new use needs a clear purpose, a lawful basis and, where applicable, an assessment of whether it is compatible with the original purpose. Consent is one possible basis; relying on legitimate interests also comes with conditions. The resulting decisions should determine the data used, who can see it and how long it is kept. Removing names does not necessarily make a report anonymous, and profiling is not automatically the same as a prohibited automated decision.",[18,26,27],{},"A hotel wants to decide which packages to offer next season. Its booking system already holds years of guest records and spending history. Management asks the software team to compare spending on extras across families with children, couples and groups of friends, taking account of where guests come from and how long they stay.",[18,29,30],{},"Answering that question could help the business. But the request could produce very different systems: a report showing broad spending patterns, a searchable list of individual guests, or a model predicting what each person will spend on their next visit.",[18,32,33],{},"Those differences matter before anyone exports the booking database. GDPR compliance depends on what the business does with personal data, as well as where it stores them.",[18,35,36],{},"For this example, assume the hotel operates in the EU and decides how guest information is used. The scenario is hypothetical. We are looking at customer analytics, leaving international transfers and country-specific hotel rules for separate discussions.",[38,39,41],"h2",{"id":40},"does-the-original-purpose-cover-the-new-analysis","Does the original purpose cover the new analysis?",[18,43,44],{},"Taking a reservation and deciding next season's commercial offer are different purposes. A hotel may need a guest's details to fulfil a booking, but that does not make every later use necessary for the contract.",[18,46,47,48,57],{},"The ",[49,50,56],"a",{"href":51,"rel":52,"target":55},"https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2016\u002F679\u002Foj\u002Feng",[53,54],"nofollow","noopener","_blank","GDPR's purpose-limitation and lawful-processing rules"," require more than a broad label such as “business improvement.” Here, the purpose might be to compare demand and spending across guest groups so management can choose which packages to test.",[18,59,60],{},"Does the analysis need individual records? Which attributes actually help answer the question? What could the results mean for the people whose data are used?",[18,62,63],{},"GDPR also has a specific rule for further use. Where the new use is not based on consent or a qualifying legal provision, Article 6(4) requires an assessment of compatibility with the original purpose. That assessment considers the relationship between the purposes, the collection context, the nature of the data, possible consequences for guests and safeguards.",[18,65,66],{},"Compatible further use may continue on the original lawful basis; a new purpose does not always require fresh consent. However, compatibility cannot extend consent beyond the specific purposes it covered. For an incompatible use, the hotel needs consent for the new purpose or a qualifying EU or national law permitting it. Switching to legitimate interests does not solve that problem. Complete this assessment before processing begins.",[38,68,70],{"id":69},"consent-is-not-the-only-route","Consent is not the only route",[18,72,73],{},"Commercial analytics does not automatically require consent. Depending on the circumstances, legitimate interests may be available. The hotel must identify its legitimate interest, establish that the processing is necessary and weigh that interest against guests' rights and interests.",[18,75,76],{},"Wanting better commercial decisions is only the start. If a less intrusive analysis can answer the question just as effectively, giving analysts full guest histories becomes harder to justify. Guests' reasonable expectations also matter: information provided to arrange a stay is not an invitation to build any profile the business finds useful.",[18,78,79,80,85],{},"Where consent is the appropriate basis, it must be specific, informed and freely given. The ",[49,81,84],{"href":82,"rel":83,"target":55},"https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002Fdocuments\u002Ffiles\u002Ffile1\u002Fedpb_guidelines_202005_consent_en.pdf",[53,54],"European Data Protection Board's consent guidance"," explains why optional processing should not be bundled into a service that does not need it. A guest should be able to decline optional analytics without losing their room booking, and withdrawal must be as easy as giving consent.",[18,87,88],{},"A privacy notice serves a different purpose: it explains the processing. It is required whether the business relies on consent or another basis. If the hotel introduces a further purpose, guests must receive the relevant information before that processing begins. Updating a notice does not, by itself, make the new use lawful.",[38,90,92],{"id":91},"how-much-guest-information-does-the-report-need","How much guest information does the report need?",[18,94,95],{},"For the proposed comparison, useful fields might include adult and child counts, length of stay, country of residence and spending by service. Group composition could also be relevant. If management wants to compare spending by the gender composition of travel groups, it first needs to explain how that comparison would inform the package decision. Gender should not be treated as an established predictor of spending.",[18,97,98],{},"Each field needs a reason to be there. Counting children does not automatically require their names or full birth dates. Sharing a booking does not prove that people are a family or a couple. Adding such labels without reliable information can create misleading results as well as unnecessary personal data.",[18,100,101],{},"The analyst may only need grouped figures. But a dashboard can still reveal individuals if filters narrow the result to a particular hotel, a short date range and an unusual travel group. Someone with access to reservations may recognise the guests.",[18,103,104,105,110],{},"The EDPB's ",[49,106,109],{"href":107,"rel":108,"target":55},"https:\u002F\u002Fwww.edpb.europa.eu\u002Ftopics\u002Fai-and-technology\u002Fanonymisation-pseudonymisation_en",[53,54],"explanation of anonymisation and pseudonymisation"," makes the distinction clear: replacing names with codes is a safeguard, not necessarily anonymisation. A result is not genuinely anonymous if someone can reasonably identify a guest by singling them out, linking the report with other data or drawing inferences from the available information. The processing used to create it still needs to comply with GDPR while identifiable data are involved.",[18,112,113],{},"For this report, practical safeguards could include combining small groups, restricting filters and preventing access to underlying bookings. Their adequacy depends on the actual data and what users can connect them with.",[38,115,117],{"id":116},"when-analysis-becomes-profiling","When analysis becomes profiling",[18,119,120],{},"Planning packages from anonymous group totals is different from predicting a particular guest's spending power. Automated processing that evaluates personal aspects of an individual can constitute profiling, even if nobody calls the software a profiling tool.",[18,122,123,124,129],{},"Profiling is not automatically prohibited. Nor does every dashboard fall under Article 22, which concerns decisions based solely on automated processing that have legal or similarly significant effects. The EDPB's ",[49,125,128],{"href":126,"rel":127,"target":55},"https:\u002F\u002Fwww.edpb.europa.eu\u002Fdocuments\u002Fguideline\u002Fautomated-decision-making-and-profiling_en",[53,54],"endorsed guidance on profiling and automated decisions"," explains that distinction.",[18,131,132],{},"If the hotel later uses the model to decide individual guests' prices or eligibility for offers, the assessment must cover that use and its consequences. Whether Article 22 applies depends on the decision's effects and whether human involvement is meaningful. A staff member merely approving a machine's recommendation is not necessarily enough.",[18,134,135],{},"Even where Article 22 does not apply, the ordinary duties of lawful processing, transparency, fairness and data minimisation remain.",[38,137,139],{"id":138},"make-the-software-reflect-the-decision","Make the software reflect the decision",[18,141,142],{},"Suppose management only needs a report for planning packages. The application should deliver that report without automatically giving its users access to names, contact details and complete booking histories.",[18,144,145],{},"Article 25 requires data protection by design and by default. In this example, that means deciding which records enter the analysis, limiting access to the people who need it, setting retention periods and controlling exports. Hiding a screen button is insufficient if the same user can retrieve the data through another route.",[18,147,148],{},"The lawful basis also affects how the system handles requests. If analytics relies on consent, withdrawal must stop the processing that depends on it. It does not retrospectively invalidate earlier lawful processing or necessarily require deletion of records retained for a separate lawful purpose.",[18,150,151],{},"Where processing relies on legitimate interests, a guest may object on grounds relating to their particular situation. The business must then stop unless it can demonstrate compelling legitimate grounds that override the guest’s interests, rights and freedoms, or show that it needs the data for legal claims. Direct marketing has a stricter rule: after an objection, processing for that purpose, including related profiling, must stop. Internal planning and personalised marketing should not be treated as interchangeable.",[18,153,154],{},"Staff changes matter too. Moving from revenue analysis to another role should change access. A one-off planning request should not leave a permanent export of identifiable guest records on someone's laptop.",[38,156,158],{"id":157},"include-these-decisions-in-the-report-request","Include these decisions in the report request",[18,160,161],{},"Give the software team a clear request: the question to answer, the information needed, the intended users and the limits on later use.",[18,163,164],{},"Business managers should explain what they want to learn. The legal assessment should establish the conditions for using the data. The software team should build those conditions into the report and its access controls. Settling these points before building the report reduces the chance that an apparently simple analytics feature has to be redesigned after the data have already been copied and shared.",{"title":166,"searchDepth":167,"depth":167,"links":168},"",2,[169,170,171,172,173,174],{"id":40,"depth":167,"text":41},{"id":69,"depth":167,"text":70},{"id":91,"depth":167,"text":92},{"id":116,"depth":167,"text":117},{"id":138,"depth":167,"text":139},{"id":157,"depth":167,"text":158},[176],"business",null,"2026-10-07","Can booking records become customer analytics? A hotel example explains GDPR purpose limits, legitimate interests, consent, profiling and staff access.",{"aiUse":181,"aiNote":182},"ai-assisted","Evren Bal supplied the business question and commissioned a separate GDPR treatment. AI assisted with primary-source research, development of the English text and generation of the cover illustration.",false,"md","\u002Fimages\u002Fhero\u002Fkvkk-hotel-guest-data-analysis.avif","A hotel employee reviews spending charts for families, couples and groups of friends on a computer.","Analysis","en",{},true,7,{"title":10,"description":179},"GDPR Customer Analytics: Purpose, Consent and Access","gdpr-customer-data-analytics-purpose-access",[196,197,198,199],"gdpr","customer-analytics","data-protection","access-control","gdpr-customer-analytics-purpose-access","post","wpLeG-3xUXECt5tF-tdC1Q84f7R6xJuGCNBYFN4ptjA",{"en":204,"de":205},{"path":4,"title":10},{"path":6,"title":206},"DSGVO: Wann dürfen Sie vorhandene Kundendaten analysieren?",{"prev":208,"next":177,"others":211,"lucky":330,"readingTime":191},{"path":209,"title":210},"\u002Fwhat-does-an-ai-visibility-score-measure","What Does an AI Visibility Score Measure?",[212,215,218,221,224,227,230,233,236,239,242,245,248,251,254,257,260,263,266,269,272,275,278,281,284,287,290,293,296,297,300,303,306,309,312,315,318,321,324,327],{"path":213,"title":214},"\u002Fllms-txt-was-never-the-point","llms.txt Was Never the Point",{"path":216,"title":217},"\u002Fturkey-national-ai-platform-evren","National AI Infrastructure Is More Than a GPU Count",{"path":219,"title":220},"\u002Fwriting-with-ai-means-thinking-with-your-archive","Writing with AI Means Thinking About Your Archive, Too",{"path":222,"title":223},"\u002Fwhere-should-people-be-in-the-loop-while-ai-does-the-work","Where Should People Be in the Loop While AI Does the Work?",{"path":225,"title":226},"\u002Fhow-ai-changes-the-experience-gap","Can a Junior Who Uses AI Well Outperform a Senior Expert?",{"path":228,"title":229},"\u002Fthe-cost-of-a-hello-enterprise-ai","The Cost of a Hello: Managing Enterprise AI Use",{"path":231,"title":232},"\u002Fbringing-english-back-into-my-working-day","Bringing English Back Into My Working Day",{"path":234,"title":235},"\u002Fstart-with-the-business-problem-not-the-ai-model","Start With the Business Problem, Not the AI Model",{"path":237,"title":238},"\u002Fpesintaksit-cash-vs-installments-a-turkish-inflation-aware-payment-comparison-tool","Cash or Installments? – The Story Behind PeşinTaksit",{"path":240,"title":241},"\u002Fhow-employee-built-ai-systems-become-organizational-memory","How Employee-Built AI Systems Become Organizational Memory",{"path":243,"title":244},"\u002Fbank-account-api-integration","Integrating One Bank Is Easy. Keeping Forty Running Is Not.",{"path":246,"title":247},"\u002Fdo-we-need-ai","Do We Need AI, or Are We Solving the Wrong Problem?",{"path":249,"title":250},"\u002Fopen-publishing-ai-monthly-seo-reporting-experiment","Open Publishing and an AI-Assisted Monthly SEO Reporting Experiment",{"path":252,"title":253},"\u002Fhow-llms-identify-experts","What Makes an LLM Recommend Someone as an Expert?",{"path":255,"title":256},"\u002Fwhy-the-same-ai-model-produces-different-results","Why the Same AI Model Produces Different Results Across Applications",{"path":258,"title":259},"\u002Fturkeys-first-real-time-mystery-shopping-reporting","Turkey's First Real-Time Mystery Shopping Reporting Platform",{"path":261,"title":262},"\u002Fhow-to-route-requests-across-multiple-ai-models","How Should You Route Requests Across Multiple AI Models?",{"path":264,"title":265},"\u002Fai-assisted-rest-api-development","Preserving API Quality in AI-Assisted Development",{"path":267,"title":268},"\u002Fwhat-is-an-ai-harness","What Is an AI Harness? A Plain-English Explanation",{"path":270,"title":271},"\u002Fthe-job-ai-wont-take-and-the-five-it-prevents","AI Is Reducing Hiring Without Layoffs",{"path":273,"title":274},"\u002Faugust-2026-what-i-wrote","August 2026: What I Wrote, and Why",{"path":276,"title":277},"\u002Fdont-write-to-be-recommended-by-ai","Getting Your Brand Recommended by AI Is the Wrong Goal. What Is the Right One?",{"path":279,"title":280},"\u002Fprotecting-organizational-memory-during-ai-transformation","Protect Organizational Memory During an AI Transformation",{"path":282,"title":283},"\u002Fhealthcare-ai-chatbot-triage-medical-device","AI in Healthcare: The Difference Between Chatbots, Triage, and Medical Devices",{"path":285,"title":286},"\u002Fai-smaller-teams-business-capacity","AI Makes Smaller Teams Possible. What Does the Business Gain — and Lose?",{"path":288,"title":289},"\u002Fstripe-openrouter-which-model-for-which-job","Stripe’s OpenRouter Deal: Which Model for Which Job?",{"path":291,"title":292},"\u002Fmanaging-technology-and-transforming-the-business-are-not-the-same","Managing Technology and Transforming the Business Are Not the Same Thing",{"path":294,"title":295},"\u002Feu-ai-act-after-risk-classification","EU AI Act: What Should You Do Once You Know the Risk Level?",{"path":209,"title":210},{"path":298,"title":299},"\u002Fhow-much-does-the-eu-ai-act-affect-companies-outside-the-eu","How Much Does the EU AI Act Affect Companies Outside the EU?",{"path":301,"title":302},"\u002Fwhy-we-trust-ai-judgments","Why We Trust AI Judgments and What That Fails to Prove",{"path":304,"title":305},"\u002Fai-editorial-disclosure","What an AI Disclosure Tells Readers About the Author’s Contribution",{"path":307,"title":308},"\u002Fraising-children-in-the-age-of-artificial-intelligence","Raising Children in the Age of Artificial Intelligence",{"path":310,"title":311},"\u002Fdo-you-know-how-dependent-your-company-is-on-ai","Do You Know How Dependent Your Company Is on AI?",{"path":313,"title":314},"\u002Fai-value-is-not-always-more-work","AI's Value Is Not Always More Work",{"path":316,"title":317},"\u002Fturkey-kvkk-data-contracts-foreign-providers","Turkey’s KVKK: Why Your Turkish Customer Needs Another Data Contract",{"path":319,"title":320},"\u002Ftesting-a-button-treating-an-entire-website-redesign-as-a-sure-thing","Testing a Button, Treating an Entire Website Redesign as a Sure Thing",{"path":322,"title":323},"\u002Fchatbot-data-third-party-ai-provider","What Happens When Chatbot Data Is Sent to a Third-Party AI Provider?",{"path":325,"title":326},"\u002Fwhat-does-the-eu-ai-act-actually-regulate","What Is the EU AI Act, and What Does It Regulate?",{"path":328,"title":329},"\u002Fcomprehension-debt-the-bill-comes-due-alone","Comprehension Debt: The Bill Comes Due Alone",{"path":216,"title":217},[332,336,338,340],{"path":333,"title":334,"date":335},"\u002Fdoes-turkey-kvkk-apply-european-companies","Does Turkey’s KVKK Apply to European Companies?","2026-09-24",{"path":322,"title":323,"date":337},"2026-09-05",{"path":316,"title":317,"date":339},"2026-10-05",{"path":341,"title":342,"date":343},"\u002Fsensitive-ai-data-processing-location","Where Should Sensitive AI Data Be Processed?","2026-10-03",[345,347,351],{"path":222,"title":223,"date":346},"2026-09-13",{"path":348,"title":349,"date":350},"\u002Faccessing-know-how-is-not-the-same-as-creating-it","Accessing Know-How Is Not the Same as Creating It","2026-08-15",{"path":352,"title":353,"date":354},"\u002Fredar-ai-powered-summaries-for-kap-disclosures-and-open-sources","Redar: AI-Powered Summaries for KAP Disclosures and Open Sources","2025-10-30",1791346857947]