R Shiny
R Shiny is an open-source framework from Posit (formerly RStudio) for building interactive web applications directly from R code. It is widely used in data science, research, and analytics to create dashboards, visualisations, and data exploration tools. GDPR compliance depends on the application built and where it is hosted. Self-hosted Shiny apps on EU infrastructure have no transfer concerns. Apps hosted on shinyapps.io are processed on US infrastructure requiring SCCs.
What does R Shiny do?
What is R Shiny?
R Shiny is an open-source framework developed by Posit (formerly RStudio) that allows data scientists and researchers to build interactive web applications using only R code, without requiring knowledge of HTML, CSS, or JavaScript. Shiny applications can include interactive charts, data tables, maps, machine learning model interfaces, and data input forms. They are widely used in academia, healthcare research, pharmaceutical companies, financial services, and government statistics for creating shareable data analysis tools.
GDPR and Shiny: it depends on the application
GDPR obligations for a Shiny application depend entirely on what data the application processes and where it is hosted. A Shiny app displaying only aggregated statistics with no personal data has minimal GDPR relevance. A Shiny app allowing users to upload patient records, enter personal survey responses, or interact with identifiable datasets must comply with GDPR in full. The developer and deploying organisation are the data controllers.
Hosting options and transfer implications
Shiny applications can be hosted three ways with different GDPR implications. Self-hosted on EU infrastructure (recommended for EU personal data): no third-country transfer, full control. ShinyApps.io (Posit, US): all data processed in the US, requires SCCs for EU personal data. Posit Connect on-premise or EU cloud: EU data residency possible with appropriate configuration.
Research data and special category data
Shiny is frequently used in healthcare and research contexts where special category data (health, genetic, biometric data) is processed. When a Shiny app processes such data, GDPR Article 9 applies. Research processing may rely on Article 9(2)(j) (research purposes) with appropriate safeguards, or explicit consent. A DPIA is mandatory for large-scale health data processing.
Practical compliance steps
Host on EU infrastructure for EU personal data. Implement user authentication and access controls in Shiny. Minimise data displayed and processed. Implement session timeouts to clear data from memory. Sign a DPA with the hosting provider. For shinyapps.io, sign a DPA with Posit and implement SCCs. Conduct a DPIA for health data applications.
R Shiny and the GDPR
- Legal basis
- R Shiny is a framework, not a data processor. GDPR obligations arise from the Shiny application and its hosting infrastructure. For shinyapps.io hosted applications, contract performance or legitimate interest applies for the hosting relationship.
- Risk level
- low
- Applicable regulations
- GDPR compliance depends on the application and hosting: EU self-hosted deployments have no transfer concerns
Impact assessment (DPIA)
A DPIA may be required for Shiny applications processing special category data (health, genetic data) or large-scale personal data, particularly in research or clinical contexts. The DPIA should focus on the application design and data flows, not Shiny itself.
Sample text for your banner
This data application is built with R Shiny. Data entered or uploaded to this application is processed as described in our privacy policy.
What R Shiny sets and contacts
- Tracking method
- R Shiny web application framework, server-side R processing, session cookies, optional first-party analytics
- Server location
- Self-hosted or Posit (RStudio) cloud infrastructure (US)
Cookies set (1)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| shinysession | session | Session | Strictly necessary session cookie maintaining the R Shiny WebSocket session, does not require consent |
Third-party domains contacted (2)
shiny.posit.coshinyapps.io
Frequently asked questions about R Shiny
Can't find your question? Write to us, we answer fast.
Does R Shiny collect personal data?
R Shiny itself does not. However, Shiny applications routinely process personal data uploaded or entered by users. The developer and deploying organisation are responsible for GDPR compliance for all data processed within the application.
Does shinyapps.io require SCCs for EU data?
Yes. ShinyApps.io is operated by Posit in the US. Any EU personal data processed by a Shiny app hosted on shinyapps.io is transferred to the US, requiring Standard Contractual Clauses and a DPA with Posit.
What is the most GDPR-compliant hosting option for Shiny?
Self-hosting on EU infrastructure (AWS Frankfurt, OVHcloud, Hetzner) provides full EU data residency with no transfer concerns. Sign a DPA with the hosting provider. For managed hosting, Posit Connect on an EU cloud instance is an alternative.
Does R Shiny set cookies?
Shiny sets session cookies for maintaining the R session and WebSocket connection. These session cookies are strictly necessary for the application to function and generally do not require cookie consent. Analytics scripts added to the Shiny app do require consent.
Do I need a DPIA for my Shiny application?
A DPIA is required for Shiny applications processing health, genetic, or biometric data at scale, applications making automated decisions significantly affecting users, and applications processing large volumes of sensitive personal data. Standard dashboard applications with access controls may not require a DPIA.
How do I implement user authentication in Shiny for GDPR compliance?
Use the shinyauthr or shinymanager packages for local authentication, or integrate with your organisation's SSO/OAuth2 system. Implement role-based access so users only see data they are authorised to access. Log all user access for audit purposes.
How do I handle data uploaded to a Shiny app under GDPR?
Implement automatic deletion of uploaded data when the user session ends. For data that must persist, apply retention limits, access controls, and document the processing in your RoPA. Inform users in the app interface about how their uploaded data is processed.
Does R Shiny need to appear in my privacy policy?
Only if your Shiny application is user-facing and processes personal data. Describe the application purpose, what data is processed, the legal basis, the hosting location, and how users can exercise their rights. If hosted on shinyapps.io, disclose the US transfer and SCC mechanism.
MochiKit
MochiKit is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. MochiKit supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, MochiKit ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
W3.CSS
W3.CSS is a CSS framework providing pre-built styles, components, and utility classes for building responsive web interfaces. It offers grid systems, typography scales, and design tokens for consistent styling. W3.CSS supports dark mode, custom theming, and responsive breakpoints. With modular architecture and optimized file sizes, W3.CSS helps developers create polished, professional web designs while maintaining fast page load speeds and excellent user experience.
Python
Python is a backend web framework providing a structured environment for building robust server-side applications and APIs. It offers routing, database management, authentication, and middleware support. Python follows established design patterns and conventions promoting clean, maintainable code. With ORM integration, template engines, and security features, Python accelerates backend development and enables teams to deliver scalable web applications efficiently.
GOV.UK Template
GOV.UK Template is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. GOV.UK Template supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, GOV.UK Template ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
OpenCV
OpenCV is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. OpenCV supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, OpenCV ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Glider.js
Glider.js is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Glider.js integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Glider.js helps organizations maintain robust websites that meet user expectations and technical requirements.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.