Is IP to Company Lookup GDPR Compliant? What to Document

Company-level IP lookup is generally considered easier to defend under GDPR than person-level identification, but it is not automatically compliant. The address is briefly personal data while you process it, so you need a lawful basis, disclosure, sensible retention and a processor agreement. This is not legal advice.

Two different practices

Most confusion comes from mixing up two things.

Practice	What it produces	Typical risk
Company-level resolution	Name of the organisation operating a network	Lower: firmographic output, nothing about a named individual
Person-level resolution	A named individual, often with contact details	High: unexpected by the visitor, hard to justify without consent

An IP to company API such as BusinessMCP’s returns a company verdict, and its page says it never identifies a person from an IP and that consumer-line addresses return no company. That design choice is what makes the company-level route more defensible. BusinessMCP’s separate GDPR guide states the same position, adding that person-level resolution is an opt-in feature restricted to US traffic. As a vendor document, treat it as one perspective and read the primary law as well.

Where GDPR does and does not bite

GDPR protects personal data about individuals, not facts about organisations. A company’s name, size and industry are not personal data in themselves. But the input to the lookup, the visitor’s IP address, can relate to an identifiable person, so processing it falls within the regulation for as long as you hold it. The official text of the lawful bases is in Article 6.

Key takeaway: the output can be company-level, but the input is personal data while you hold it. Keep the raw address only as long as you need it.

Lawful basis

Of the six bases, consent, contract, legal obligation, vital interests and public task rarely fit a marketing analytics lookup. Legitimate interests under Article 6(1)(f) is the usual candidate. It requires three parts:

1. Purpose. A specific, lawful interest, such as understanding which organisations use your content or protecting your site from abuse.
2. Necessity. Whether you could achieve the purpose with less data. Company-level output instead of person-level is part of the answer.
3. Balancing. Whether visitors’ rights override your interest, considering what they would reasonably expect.

Write this down as a short, dated legitimate interest assessment. The UK ICO and the European Data Protection Board have published guidance on the test; read it directly rather than relying on a summary here.

Cookies and trackers are a separate question

The IP lookup does not itself store anything on the device. The tracker that collects visits might. Under ePrivacy rules, as implemented in the EU and the UK’s PECR, storing or reading non-essential identifiers on a device generally needs consent. A persistent cross-site identifier in local storage is effectively a cookie.

BusinessMCP’s guide describes its tracker as cookieless but notes it stores a first-party identifier, and advises that EU and UK sites gate it behind consent. If you only resolve addresses from server logs, you avoid the tracker question, but you still handle personal data in the logs.

Practical checklist

Policy and disclosure

• Name the practice in your privacy policy: that you resolve IP addresses to organisations.
• State the purpose, the category of provider, retention and how to object.

Contracts and records

• Sign a data processing agreement with the lookup provider.
• Record the activity in your register of processing.
• Check international transfer mechanisms if the provider is outside the EU or UK.

Operations

• Set a retention period for raw addresses and enforce it. BusinessMCP says it clears full IPs after resolution and keeps only a network prefix for 30 days; ask any vendor the equivalent question.
• Keep output at company level. Do not join addresses to individual profiles unless you have a separate basis.
• Honour objections and suppression requests.
• Review the set-up annually.

What changes in the US

US state laws such as the CCPA and CPRA work mostly on an opt-out model. They require disclosure and honouring of opt-out and deletion rights, and the Global Privacy Control signal is treated as a binding opt-out of sale or sharing in several states. BusinessMCP’s guide notes this applies to ad-sharing, not first-party analytics. Verify with counsel for the states you target.

Questions to put to any vendor

Question	Good answer
What do you return?	Company-level verdict, not a person
How long do you keep the address?	Short, stated and enforced
Where is data processed?	Named regions, with transfer terms
Do you offer a DPA?	Yes, on request
Is person-level data available?	Optional, geo-restricted, separate terms

Related reading

For the mechanics, see how IP to company lookup works. For turning results into follow-up while staying within policy, see identifying companies visiting your website and lead scoring with IP data.

A final caution: laws differ by country and sector, and enforcement guidance evolves. Use this as a map of the questions, then take advice for your own situation. Being able to show a regulator a dated assessment, a signed processor agreement and a retention schedule is worth far more than any vendor’s marketing claim about compliance.

A sample legitimate interest assessment outline

A short written assessment is more useful than a long one. Keep it to a page with these headings, dated and signed off by whoever owns privacy in your organisation.

Section	What to write
Purpose	One or two sentences: why you resolve addresses to organisations
Necessity	Why company-level output is enough, and what you chose not to collect
Data	Input (IP address), output (organisation verdict), who the processor is
Retention	How long raw addresses are kept, and when they are deleted or truncated
Expectations	Why a visitor to a business site would reasonably expect this, and how you tell them
Safeguards	Access limits, no person-level joins, objection route
Outcome	Your conclusion, the review date and the owner

The point is not paperwork for its own sake. Writing the assessment forces the decisions that reduce risk: shorter retention, narrower output and clearer disclosure. If you cannot write a convincing “necessity” paragraph, that is a sign you are collecting more than you need.

When to get advice

Take professional advice if you operate in a regulated sector, process traffic from children or sensitive categories, transfer data outside the EU or UK, or plan to combine IP results with person-level data. Also take advice if a regulator or customer asks for your assessment and you do not have one. Vendor guides, including BusinessMCP’s, are a reasonable starting checklist, but they are written by a company with something to sell, and they do not replace advice on your facts.