GDPR and COUNTER reports
28 May 2026A fun puzzle crossed my desk recently, and I thought it would make a good tech support post. This is a question about the General Data Protection Regulations (GDPR) in the EU and UK, and what can or cannot be shared between data centres in different jurisdictions.
“As I understand it, for some EU countries, there is a requirement that administrative data must remain within the EU region data centers. I think some of this is related to administrator credentials as well as personal data that may be administered via a module. My assumption is that COUNTER reports are not included in this, so sharing usage across regions is OK.”
I am not a lawyer
I checked this with a colleague who’s much hotter on GDPR than I am, but you need to know that neither of us are lawyers. If there’s enough interest in this question, I can look into getting a formal legal response!
Usage versus User data
GDPR protects the privacy and data security of individuals. As such, my understanding is that GDPR applies to administrator credentials and to any other data that you hold about individual users. For shorthand, I’m calling that user data. GDPR requires publishers with user data about EU or UK citizens to hold the data in data centres in those jurisdictions and not transferred elsewhere.
COUNTER reports don’t have user data. The lowest level of aggregation in a COUNTER report would be a whole calendar month of activity across an entire institution, for a single Item (e.g. article) – though most reporting is on the Title (e.g. journal) or Database level. Because COUNTER reports show usage but not user data, my understanding is that GDPR does not apply. That means reports can be shared across jurisdictions.
What about syndicated usage?
Our syndicated usage best practice says that publishers and syndicators can share data in line with data protection regulations. Let’s take ResearchGate as our example:
- If ResearchGate shares processed, ready-to-go COUNTER reports, GDPR does not apply. Remember, the reports include usage but not user data. ResearchGate and other syndicators can share reports across regions.
- If ResearchGate shares raw data for the publisher to process, the raw data does include user credentials, and GDPR does apply. So syndicators cannot share raw data across regions.