Agri-food · GDPR

Agri-food — GDPR: a variety of processing activities to govern

The agri-food sector processes data relating to employees, customers (distribution, loyalty programmes) and B2B commercial relationships, with particular attention to video surveillance at production and logistics sites. This guide details these processing activities and a tailored roadmap.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: GDPR.
  • Producers, processors and distributors are data controllers, without any threshold.
  • Maintain a register.
  • Governing video surveillance.
  • Framing loyalty schemes and marketing.
  • Fines of up to €20M or 4% of global turnover.

Regulatory deadlines

The key dates of this regulation.

May 2018

Entry into application

In force

What does GDPR cover?

GDPR applies to personal data across the sector: HR, distribution customers, commercial contacts. Video surveillance of sites (production, warehouses) is a sensitive point due to employee monitoring considerations.

Purely technical production data falls more within the scope of the Data Act.

Is the 'Food & Beverage' sector concerned?

Producers, processors and distributors are data controllers, without any threshold. Consumer retail also processes customer data at large scale (loyalty programmes).

Service providers (software, logistics) are processors and must be governed accordingly.

Detailed obligations

Maintain a register

Documenting HR, client and commercial processing activities.

Governing video surveillance

Legal basis, employee information, proportionality and retention periods for footage.

Frame loyalty and marketing

Legal bases and information requirements for loyalty programmes and prospecting.

Mastering retention periods and security

Tailored retention periods and security for customer and HR data.

Distinguishing the regimes

Separate personal data (GDPR) from production data (Data Act).

Sanctions & risks

Fines of up to €20M or 4% of global turnover. Disproportionate employee video surveillance and non-compliant marketing are frequent grounds.

Common mistakes in the sector

  • 1Disproportionate video surveillance. Continuously monitoring workstations without justification.
  • 2Unregulated loyalty. Exploiting loyalty data without a clear legal basis.
  • 3Incomplete register. Overlook processing activities.
  • 4Excessive retention. Retain customer data for too long.

Practical case

A production site had deployed extensive video surveillance and a loyalty programme without clear information notices. Remediation involves ensuring surveillance proportionality, informing employees and customers, and defining retention periods.

Compliance roadmap

  1. 1

    Map. Map HR, customer, and commercial data.

  2. 2

    Governing video surveillance. Proportionate and inform.

  3. 3

    Frame marketing. Legal bases and loyalty.

  4. 4

    Secure. Retention periods and security.

  5. 5

    Document. Maintain the register.

Frequently asked questions

Yes: legal basis, information, proportionality and retention periods.

Back to the Agri-food guideAgri-food & NIS2

Take action on GDPR

Free assessment or a chat with an expert dedicated to agri-food.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the agri-food sector secured their compliance with DCO.

See testimonials