Grafana

What is Grafana

Grafana is the most widely used open source observability and dashboarding platform. Created by Torkel Odegaard in Stockholm in 2014, it is now developed by Grafana Labs (HQ in New York). It connects to dozens of data sources (Prometheus, InfluxDB, Elasticsearch, Loki, Tempo, ClickHouse, Postgres) to display metrics, logs, traces and alerts in unified dashboards.

Grafana is most commonly an internal tool for engineering and operations teams. The end user facing component is Grafana Faro, a JavaScript SDK and backend that bring Real User Monitoring and frontend error tracking to public websites and applications.

Deployment models

Self-hosted Grafana runs on customer infrastructure (Kubernetes, VMs, on premises). No data leaves the customer environment for the Grafana application itself; GDPR concerns reduce to the underlying data sources and any reverse proxy in front.

Grafana Cloud is the SaaS offering operated by Grafana Labs. EU customers can choose Frankfurt or Sweden as primary region. Data residency in the EU is contractually committed for those regions, but Grafana Labs corporate functions (support, billing, security operations) may still be performed from the US.

Grafana Faro and frontend observability

When deployed on a public website, Grafana Faro captures visitor IP, User Agent, page URL, JavaScript errors, performance metrics, and (optionally) user interactions and session replays. This brings it into the same regulatory scope as Sentry, Datadog RUM or Raygun: legitimate interest can be defensible for basic error monitoring, but consent is the safer basis for RUM with user identifiers.

Configure Faro to anonymise IP, mask sensitive fields and limit retention. Avoid sending special category data through Faro custom attributes.

GDPR and data transfers

Grafana Labs Inc. is a US controller. For Grafana Cloud, a signed DPA is required, with SCCs covering any access from the US for support purposes. The Frankfurt or Sweden region keeps the bulk of customer data in the EU, but the publisher should perform a TIA documenting access patterns by Grafana Labs staff.

For self-hosted Grafana, transfers depend on the underlying infrastructure choice. No additional transfer takes place via the Grafana application itself.

Dashboards and special category data

Custom Grafana dashboards may aggregate personal data from various sources (logs containing user IDs, metrics labelled with email addresses, etc.). In healthcare, HR or financial contexts, dashboards can inadvertently expose special category data. Use Grafana Enterprise role based access control and audit logs to restrict who can see which dashboards.

Avoid embedding identifying values in metric label names (use IDs that are hashed or pseudonymised).

Practical compliance checklist

For Grafana Cloud: sign the Grafana Labs DPA, choose Frankfurt or Sweden, list Grafana Labs in your RoPA. For Grafana Faro on public sites: defer the SDK until consent (if RUM with identifiers is enabled), anonymise IP, scrub PII from error reports. For self-hosted: secure the dashboards with RBAC and audit logs, and protect the underlying data sources separately.

Document the dashboards that may contain personal data and their access rules in your security policy. Review at least annually as data sources evolve.