GDPR-compliant vs approved by an authority: what the difference means for people counting
Every people-counting supplier in Europe describes itself as GDPR-compliant. This page sets out what the phrase covers when the supplier assesses itself, what a regulator's review adds, and how to tell which one you are buying.
On this page
“GDPR-compliant” is normally the supplier’s own conclusion, because GDPR makes organisations responsible for their own compliance. “Approved” means a regulator examined the method. Bumbee Labs has the only footfall method in Europe approved by a data protection authority. IMY, the Swedish Authority for Privacy Protection, issued the approval for our Wi-Fi footfall method.
Is “GDPR-compliant” a self-assessment?
Mostly, yes. Read any people-counting website in any European language and the same phrase appears: GDPR-compliant, DSGVO-konform, conforme au RGPD, RODO-compliant. The phrase costs nothing to write, and in almost every case the supplier reached the conclusion itself, since GDPR does not hand out product badges. What the supplier usually means is its honest reading of its own architecture, backed by a privacy policy and a data processing agreement template.
When every supplier uses the same words, the claim no longer tells careful engineering apart from wishful thinking, so your compliance review starts from zero. Someone on your side has to examine what the system collects, keeps and could expose, and the supplier’s self-description is one input to that work.
What does a regulator’s review add?
A data protection authority is the body GDPR appoints to judge these questions. When it examines a measurement method it asks what your DPO would ask, with more mandate and more depth: what is collected, what happens to it, what remains, and whether any individual could be identified at any stage.
Bumbee Labs went through that examination and holds the approval from IMY, issued after a review of how signals are collected, irrevocably deleted and reduced to anonymous, aggregated statistics.
Because GDPR is one regulation across the EU and EEA, IMY answered the question a reviewer in Paris, Munich or Milan starts from: does this produce personal data? An approval does not end your review, but your DPO can verify documented findings rather than investigate a claim from scratch.
Does the approval cover every method you deliver?
The approval covers the Wi-Fi footfall method. The same privacy-by-design engineering goes into everything we deliver alongside it, from 3D sensors to LiDAR and cellular analytics. When a supplier says “approved”, check which method the review covered. Question 2 below asks that.
How do I tell which one I am buying?
Put three questions to any supplier, including us, and ask for the answers in writing:
- What independent review has the method passed, and by whom?
- What exactly did the review cover: which method and which data journey?
- What documentation can the supplier hand your DPO?
A self-declared supplier answers the first question with its own policies. That may be sound, but it is a different product from the one in the sales deck, and your legal team should know which of the two it is signing off.
The GDPR footfall analytics page walks through our answers in full, and the DPIA guide collects the questions a DPO typically asks with pointers to where each answer lives. If you are writing a tender, procurement for people counting shows what a tender can require.
Curious what this looks like for your venue?
Frequently asked questions
Is "GDPR-compliant" a certification?
No. GDPR does not certify products by default. Unless a regulator or an accredited body has examined a system, 'GDPR-compliant' is the supplier's own conclusion about its own product. It may be correct, but the phrase alone does not show that anyone independent has checked.
What exactly was approved in Bumbee Labs' case?
IMY, the Swedish Authority for Privacy Protection, reviewed Bumbee Labs' Wi-Fi footfall method: what is collected, what is deleted and what remains. No other footfall method in Europe has that standing. The same privacy-by-design engineering goes into every method we deliver alongside it.
Does an approval from one EU authority matter in other countries?
Every member state applies the same regulation, so a reviewer anywhere in the EU or EEA asks the same thing: does this produce personal data? A method that has answered it in front of a data protection authority gives your DPO documented evidence to start from, wherever you operate.
How should procurement test a compliance claim?
Ask every supplier the same three things in writing: what independent review has your method passed, what exactly did it cover, and what evidence can you attach? Self-declared compliance answers with policy documents, reviewed compliance with a regulator's conclusion.