If you run a UniFi network, you process personal data – often without realising it. Your controller knows every connected device, logs connections and, depending on its configuration, stores detailed usage information. Once the controller no longer sits in your own server room but runs with a hosting provider or is managed through cloud services, a question comes up: what does the GDPR require, and what should you look for when choosing a host? This guide gives you a practical overview. It is not legal advice, but it will help you ask the right questions.
What personal data does a UniFi controller process?
Under the GDPR, personal data is any information that can be linked to an individual – directly or with additional knowledge. In network operations this covers more than many people expect. In its Analytics Data Collection FAQ, Ubiquiti itself points out that even a device’s MAC address may be considered personal data by some regulatory bodies and must be treated accordingly. A controller typically holds:
- Client data: MAC and IP addresses of connected devices – the laptops and smartphones of your employees or guests.
- Device and traffic identification: With a UniFi gateway, Device Identification lists the manufacturer, model and operating system of clients, according to Ubiquiti. Traffic Identification shows what type of traffic – for example which apps – passes through the gateway.
- Traffic Flows: From UniFi Network 9.1, supported gateways log detailed connection data, including source and destination ports, bytes transferred and session duration. Depending on the host, Ubiquiti states that UniFi can retain up to several million entries.
- Guest network and hotspot: If you use the Hotspot Portal, further data may be added depending on the authentication method, such as Facebook login, payment via Stripe or RADIUS.
- Administrators: The accounts of the admins who manage the controller.
This does not mean you cannot use these features. It does mean the GDPR applies – regardless of where your controller runs.
Your role: you remain the controller
As the operator of the network, you (or your company) are the data controller under the GDPR. If you outsource the operation of your UniFi controller to a host, that provider processes the data on your behalf. Article 28 GDPR requires a data processing agreement (DPA) for this. Among other things, it sets out that the provider acts only on your instructions, which technical and organisational measures it takes and whether it uses sub-processors.
Network management also belongs in your record of processing activities under Article 30 GDPR. For many small businesses this is a manageable task – but one that is easy to forget.
Where is the data? Server location and international transfers
Server location is not an end in itself, but it simplifies a lot. If personal data is transferred to a country outside the EU/EEA, the additional requirements of Articles 44 et seq. GDPR apply – for example an adequacy decision by the European Commission or standard contractual clauses. For the United States, the EU-U.S. Data Privacy Framework (DPF) has existed since 2023, under which US companies can self-certify.
If your controller and its backups are stored exclusively in Germany, this assessment is not needed for the hosting itself. That is particularly helpful when your customers or your data protection officer ask for clear evidence.
Don’t forget Ubiquiti’s own services
Even if your controller runs in Germany, Ubiquiti’s own cloud services can come into play. Two points are worth knowing:
Remote Management and Site Manager
The UniFi Site Manager at unifi.ui.com lets you manage your deployments centrally with your UI Account. According to Ubiquiti, Remote Management is enabled by default during initial setup. Ubiquiti states that data is encrypted in transit and refers to its privacy policy, in which it declares participation in the EU-U.S. Data Privacy Framework. For your documentation, this means: if you use Site Manager, Ubiquiti is an additional party to consider. If you would rather avoid that, Ubiquiti says UniFi can also be managed purely locally, without cloud management. Learn more in our guide to the UniFi Site Manager.
Analytics & Improvements
Ubiquiti runs an analytics framework to improve its products. According to Ubiquiti, personal data such as MAC addresses is only collected if the administrator has enabled Analytics & Improvements – in the device settings of Site Manager or under UniFi OS > Console Settings > Advanced. Other, non-personal data, such as which features are enabled, is reported automatically. Check whether this option is enabled in your setup and make a deliberate decision.
Data minimisation: collect only what you need
The GDPR requires data minimisation and storage limitation (Article 5(1)(c) and (e)). For UniFi, this means using features that generate a lot of usage data deliberately.
- Traffic Flows are valuable for security and troubleshooting. Define what you need them for, who may view them and how long exported logs – via CSV, NetFlow (IPFIX) or to a SIEM – are kept.
- SSL Deep Inspection on enterprise gateways decrypts traffic. Ubiquiti recommends the Specific mode and, in All mode, advises excluding healthcare, government and financial websites because they contain confidential information. In Specific mode, users‘ search queries can also be viewed. Particular care is needed here.
- Employees: In Germany, technical systems suitable for monitoring employee behaviour or performance are subject to the works council’s co-determination rights (Section 87(1) No. 6 of the Works Constitution Act). Clarify user-level analysis internally before you start.
Checklist: what to look for in UniFi hosting
| Criterion | What to check |
|---|---|
| Server location | Controller and backups in Germany or the EU |
| Data processing | DPA under Article 28 GDPR, list of sub-processors |
| Technical security | Firewall, DDoS protection, TLS certificate, updates |
| Data centre | Verifiable certification, e.g. ISO/IEC 27001 |
| Backups | Regular backups, also stored within the EU |
| Ubiquiti cloud services | Deliberate decision on Site Manager and analytics |
| Access | Assign admin roles sparingly, two-factor authentication |
| Deletion | What happens to the data when you cancel? |
For hardening the controller itself, see our guide on how to secure your UniFi controller; for protecting your configuration, read UniFi controller backup & restore.
Conclusion
GDPR-compliant network hosting is not rocket science, but it requires a clear view of your data flows. You remain the data controller, you need a DPA with your host, and you should know which Ubiquiti services are involved in addition. A controller whose data is stored exclusively in Germany removes the international-transfer assessment for the hosting itself. At clevendo, your UniFi controller runs in an ISO/IEC 27001 certified data centre with daily backups mirrored to a second German data centre. Have questions about hosting your controller? Get in touch with the clevendo team.
Frequently asked questions
Is a MAC address personal data?
It can be, if the device can be linked to an individual. Ubiquiti itself states that a MAC address could fall under the category of personal data as defined by some regulatory bodies and must be treated accordingly.
Do I need a DPA with my UniFi host?
Yes, if the host processes personal data on your behalf – which is usually the case for a hosted controller holding client data. Article 28 GDPR requires a data processing agreement for this.
Is a server location in Germany enough for GDPR compliance?
No. It simplifies the assessment because there is no international transfer for the hosting. You still need a DPA, appropriate security measures, an entry in your record of processing activities and a deliberate decision on additional services such as Ubiquiti’s Site Manager.
Can I run UniFi without Ubiquiti’s cloud?
According to Ubiquiti, UniFi Local Management is also intended for fully air-gapped setups without any cloud management. You do, however, give up Site Manager features such as central remote management via unifi.ui.com.
Does UniFi send data to Ubiquiti?
According to Ubiquiti, non-personal data, such as which features are enabled, is reported automatically through its analytics framework. Personal data such as MAC addresses is only collected if the administrator has enabled „Analytics & Improvements“.