Personal data on an IoT platform: what counts, and how to handle it

General information, as of October 2026. This article is not legal advice. How data protection law applies depends on the facts of each project. Consult a qualified lawyer or your data protection contact for specific questions.

A sensor in a field measures soil. A smart meter measures electricity. Neither one measures a person. So is any of it personal data? Often not — but often more than expected. Here is how we think about it.

The legal frame

Albania's Law No. 124/2024 "On the Protection of Personal Data", adopted in December 2024 and in force since early 2025, is described by law-firm and regulator sources as aligned with the EU General Data Protection Regulation (GDPR). It replaced the earlier 2008 law. The independent Commissioner for data protection (idp.al) supervises it. Because it follows GDPR concepts, the practical approach below works for both regimes — and for customers and investors in the EU, who will expect it.

When does infrastructure data become personal data?

Personal data is information relating to an identified or identifiable natural person. The test is whether data can be linked to a person, directly or indirectly — not whether it was collected as personal data.

• Usually not personal: a pump's pressure, a tank's level, an inverter's temperature, a greenhouse's humidity.
• Can be personal: electricity consumption of a household (it can reveal when people are home), the precise location and operating patterns of a sole trader's farm, an operator's login and action history, a vehicle charger linked to a named user.
• Often overlooked: company data about a legal entity is not personal data, but a sole trader or individual farmer is a natural person, and information about their farm may relate to them.

Combining datasets also changes the picture. Location + schedule + consumption can identify someone even when each field alone would not.

Who is responsible? Controllers and processors

• The controller decides why and how personal data is processed.
• The processor processes it on the controller's instructions.

On a B2B platform, the customer usually remains the controller for data about its own site and staff, and the platform provider acts as a processor under a written data processing agreement (DPA). For the platform's own account data — user names, emails, login logs, support tickets — the provider is typically a controller. Roles should be stated clearly in the contract, not left to guesswork.

Principles that should shape the design

1. Lawfulness, fairness, transparency. Have a lawful basis, and tell people what happens to their data.
2. Purpose limitation. Data collected to run an irrigation system should not quietly become marketing data.
3. Data minimization. Collect what control and reporting need. Do you need household-level readings every second, or is a 15-minute interval enough?
4. Accuracy. Fix errors; flag bad sensor data rather than letting it drive decisions.
5. Storage limitation. Keep raw high-resolution data for a defined period, then aggregate or delete.
6. Security. Encryption in transit and at rest, access control, audit logs — see securing connected infrastructure.
7. Accountability. Be able to show how you comply: records, policies, decisions.

Privacy by design, in practice

• Separate identity from telemetry. Store identifiers separately and pseudonymize where analysis does not need names.
• Role-based access with least privilege, enforced server-side, with each customer's data isolated from others.
• Retention schedules per data type — raw telemetry, aggregates, audit logs, backups.
• Avoid unnecessary precision. Round or generalize locations in reports and public material.
• Think about the people behind the logs. Operator audit trails protect the system, and they are also data about employees — document the purpose and keep them proportionate.

Cross-border processing

Cloud services may process data outside Albania, including in the European Economic Area. Know where data is stored and processed, who the sub-processors are, and which legal safeguards cover any transfer. Contracts with providers should reflect this.

People's rights and incidents

Individuals may have rights of access, correction, erasure, restriction, objection, and portability, and the right to complain to the regulator. Have a simple, known route for handling requests. For breaches, GDPR-style regimes expect fast reporting — the GDPR sets 72 hours to notify the supervisory authority where required. Because Albanian law is aligned with the GDPR, plan for a comparable timeline and confirm the exact provisions that apply. Decide in advance who investigates, who decides, and who notifies.

What this means for greecon.earth

Our own approach to personal data on the website is set out in the Privacy notice: we collect contact details you send us and standard technical logs, we do not sell personal data, and the notice explains your rights and how to exercise them. For privacy questions, write to privacy@greecon.earth.

Good infrastructure data protection is mostly good engineering: collect less, protect it well, and keep a clear record.