Fiche 12/54 Part I — General Introduction Advanced Reviewed 2026-08-23

Practical Case Study: Ecosystem Qualification

Analyzing a real-world case, such as a cloud-based health tracking mobile app, demonstrates how foundational concepts interlock: identifying sensitive data streams, characterizing processing actions,

Open in interactive reader

🧪 Operational Case Study ⚖️ Art. 4, 9, 28 Analysis

Practical Case Study: Health App Ecosystem

⚡ In 30 seconds

Scenario: A company develops a mobile health app collecting heart rates and GPS tracks, hosted on a European cloud provider, with external technical maintenance. The app developer is the Data Controller, the cloud provider and maintenance vendor are Data Processors, and the biometric/health records constitute Special Categories of Data (Art. 9).

Ecosystem Actor	GDPR Legal Status	Key Obligations
App Publisher	Data Controller (Art. 4.7)	Determines purpose (fitness tracking), collects explicit consent (Art. 9.2.a), executes DPIA.
Cloud Hosting Provider	Data Processor (Art. 4.8)	Stores encrypted data on documented instructions; signs mandatory Article 28 DPA.
Maintenance Agency	Sub-processor / Processor	Remote diagnostic access; requires confidentiality commitments and strict access logs.

⚡ Key Takeaways

Heart rates and sleep cycles are health data under Article 9(1).
Technical providers without business interest in the data are processors, not joint controllers.
Encrypted hosting remains processing: an Art. 28 contract is legally mandatory.

⚠️ Common Pitfall

Assuming that encrypting data before uploading to AWS or Azure removes the requirement for a Data Processing Agreement (DPA).

🛠️ In Practice

Implement end-to-end encryption and systematically sign Article 28 Data Processing Agreements with every cloud provider.

⚖️ Official Sources: Art. 4(7), 4(8), 9, 28 GDPR · EDPB Guidelines 07/2020 ✓ Legal review: 23 August 2026