Statistics software and GDPR: SPSS, Stata, MATLAB, SAS, JMP, Mathematica, Minitab, JASP and EViews

Desktop statistics packages are often treated as low risk because the data stays on the researcher's computer. That is mostly true, but licence checks, usage telemetry, cloud editions and new AI assistants change the picture. This guide sets out what nine common packages document, read on 7 October 2026, and how to keep research data safe on the endpoint.

Published 7 October 2026 · Sources checked 7 October 2026

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

These packages are widely provided by Nordic universities. OsloMet lists SPSS, MATLAB, Stata, Minitab and EViews among its student software [25]; Copenhagen Business School lists SPSS, JASP, JMP Student Edition, SAS and Stata among exam aids [26]; the University of Jyväskylä lists campus licences for SPSS and SAS and shared-cost licences for Mathematica and MATLAB [27].

Three kinds of data flow

When you assess statistics software, separate three things:

1. Research data: the datasets, outputs and scripts you analyse. With desktop software they stay on your machine or your storage. With a cloud edition, cloud storage or an AI feature, some of it goes to the vendor or its partners, and the vendor becomes a processor for your university. That needs a contract meeting Article 28 GDPR [24].
2. Licence data: names, email addresses, IDs, machine identifiers and sign-in events needed to check the licence. This is personal data about staff and students, processed by the vendor under its own privacy policy and the licence agreement.
3. Telemetry and update checks: hardware and operating system details, features used, errors, IP addresses. Often configurable.

Validemic's analysis For most desktop use, the GDPR questions are about flows 2 and 3 (transparency to users, transfers, minimisation) and about the security of the machine. Flow 1 becomes the main issue as soon as someone switches on a cloud or AI feature, which is why those features deserve an explicit rule.

Overview table

"None found" and "not found" mean we did not find it in the vendor's public documentation on 7 October 2026, not that it does not exist.

Product by product

IBM SPSS Statistics

Licensing. IBM's subscription FAQ says "Licensing is via your IBMID (often your email address)" and that the product "allows up to 2 weeks of offline use before it requires a valid internet connection to re-authenticate with the license server" [1]. Perpetual and term licences use authorisation codes instead.

AI feature. IBM promotes an AI Output Assistant that explains SPSS results in plain language [2]. IBM's setup documentation says you need an IBM Cloud account to use the watsonx.ai capabilities in the AI Output Assistant, and that "The default region is Dallas (us-south)" [3]. The page we read does not say exactly which content is sent.

Privacy policy. IBM's privacy statement, updated 25 August 2026, says its cloud and online services may collect settings, IP address, device and operating system information, crash logs and IBMid information. For business-to-business products, it says the client is responsible for personal information collected while using them [4].

Validemic's analysis Treat the AI Output Assistant as a separate cloud service. Output tables can contain small cell counts or labels that identify participants. If it is allowed at all, a university account with a European region and an IBM agreement should be in place, and personal or sensitive output kept out.

Stata

Licensing. StataCorp offers single-user, network (concurrent), student lab and site licences [6].

Updates. Official updates are fetched over the internet from the Help menu [7].

Privacy policy. StataCorp's policy, last updated 16 November 2022, lists "Stata license information" and "Device and network information, such as your IP address and operating system" among what it collects [5]. We did not find any statement that Stata transmits datasets, and we did not find a cloud or generative AI feature in Stata's documentation (checked 7 October 2026). The policy does not describe the EU transfer mechanism it relies on.

MATLAB (MathWorks)

Licensing. Under a campus-wide licence, an Individual licence authorises named users who sign in to MathWorks accounts; a Designated Computer licence uses a licence file on specific devices, including permanently offline ones; a Concurrent licence lets users run the software through a local licence manager "without having to sign in to their MathWorks Accounts" [8].

Telemetry. MathWorks collects optional user experience information: hardware and operating system, products and features used, and errors. Its FAQ says: "Your content, and information about the content within your files, is not shared with MathWorks", and users can opt in or out in MATLAB preferences [9].

Cloud and AI. MATLAB Online runs in the browser with MATLAB Drive storage [10]. The privacy policy says files stored through cloud services go to "a third-party web and systems infrastructure vendor" [23]. MATLAB Copilot "uses LLMs hosted in the cloud" and "may use additional context, like nearby code"; MathWorks says it does not use Copilot data to train AI models, users can switch Copilot off, and it is included in campus-wide licences [11].

Transfers. MathWorks participates in the EU-US Data Privacy Framework and its UK and Swiss extensions [23]. See our Data Privacy Framework guide.

Validemic's analysis For researchers, the practical risks are MATLAB Drive sync of data folders and Copilot reading code that embeds data or file paths with identifiers. Licence administrators can decide whether Copilot is available; if it is, a rule on what may be open in the editor is sensible.

SAS

Cloud for teaching. SAS OnDemand for Academics is "a free, cloud-based learning environment" for teaching and learning, with up to 5 GB of uploads per user [12]. SAS's configuration documentation lists US, European and Asia Pacific home regions, and each account connects to its home region's servers [13].

Managed cloud. A separate managed cloud privacy policy, revised 1 August 2026, covers SaaS, enterprise hosting and remote managed services. It treats the customer as data controller for customer information and says the standard contractual clauses form part of the data processing agreements SAS executes with customers when applicable [14].

Privacy policy. The main SAS privacy statement, revised 1 August 2026, excludes material SAS processes on customers' behalf through hosting, which falls under the managed cloud policy [14].

Validemic's analysis SAS OnDemand for Academics is built for teaching. If researchers use it for real participant data, SAS processes that data in the cloud, and the home region depends on the account. Check with your DPO before any personal data is uploaded.

JMP

JMP Statistical Discovery is "a wholly owned subsidiary of SAS Institute Inc." and adheres to SAS's policies; its privacy practices fall under the SAS Privacy Statement [15]. JMP's trust centre says generative AI functions are labelled within JMP Marketplace add-ons and may use third-party models, and that "JMP does not use your prompts, inputs, or any other customer data to train, retrain, or fine-tune AI models" [15]. We did not find documentation of what desktop JMP sends during activation or use (checked 7 October 2026).

Wolfram Mathematica

Licensing. Wolfram lists four activation methods: online sign-in, online key, manual activation for machines without internet, and a MathLM licence server [16].

Internet use. Some functions, such as CountryData and FinancialData, fetch data from the internet, and documentation and data updates download automatically. A Help menu setting can stop the system "from even attempting to use the internet", at the cost of those features [18].

AI. Wolfram AI Access may use models hosted by Wolfram or "connect to third-party AI providers". With notebook context switched on, content from the active notebook, "including code, data and other materials", may be transmitted, and the user must make sure it is appropriate to share. Wolfram says it will not use inputs or outputs to train generalised models for other customers without consent [17].

Privacy policy. Wolfram's privacy policy is effective 1 January 2023 and covers its products and services generally [28].

Minitab

Minitab's privacy notice, effective 15 August 2025, lists usage data such as "the types of files being imported, the types and frequency of tools and commands being used, the size and nature of projects". It says that "Unless you have disabled the functionality of our Software Update Manager, our Services periodically communicate with our servers". For cloud products it acts as a processor for customer content, and it relies on standard contractual clauses and the EU-US Data Privacy Framework for transfers [19].

JASP

JASP is free, open-source software developed by a team at the University of Amsterdam, released under the GNU AGPL version 3 for the interface and GPL version 2 for the engine [21]. Its privacy page says: "We do not collect any user data via the JASP software", while noting the policy covers the website, not the software itself [20].

Validemic's analysis Open source and no data collection make JASP easy to approve for local analysis. As with any open-source tool, your university still needs a way to keep it patched, and the security of the data depends on the machine it runs on.

EViews

EViews is published by S&P Global. Registration assigns a serial number to a machine by "sending a unique machine ID number to S&P Global Inc." along with name and serial number; manual registration with a key obtained by web, phone or email is possible [22]. We did not find an EViews-specific privacy notice or any cloud or AI feature in public documentation (checked 7 October 2026).

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

Research data security on endpoints

With desktop statistics software, the endpoint is where research data lives, and that is where most of the risk sits. The EDPB's breach examples make the point. In one case, encrypted, password-protected devices were stolen, but with backups and a remote wipe the EDPB found no notification was needed. In another, an unprotected notebook computer was stolen and both the supervisory authority and the individuals had to be notified; the EDPB said encryption and strong passwords could have prevented that [29].

The EDPB's advisable measures for devices include turning on device encryption, passwords on all devices, multi-factor authentication, central device management with remote wipe, minimum user rights to install software, and avoiding storing sensitive information on mobile devices or hard drives where possible [29]. Applied to quantitative research:

• Work on pseudonymised data. Remove direct identifiers before analysis and keep the key elsewhere. Pseudonymised data is still personal data, so the other measures still apply.
• Use secure environments for sensitive data. Many universities provide one; check whether the statistics packages you need are available inside it.
• Control sync folders. Check that the folders your software opens and saves to are not silently synced to personal or unapproved cloud storage, including vendor clouds such as MATLAB Drive.
• Watch outputs. Tables with small cells, residual plots with labels and saved workspaces can carry personal data. Treat them like the dataset.
• Manage the licence data too. Prefer licence servers or designated-computer licences where you want to minimise per-user sign-ins, and tell users what licence data the vendor receives.

If a laptop with research data is lost, see our data breach response guide.

Checklist for IT and DPOs

1. Inventory editions. Which packages, which licence types, and which cloud editions are in use?
2. Map flows. For each product, record licence data, telemetry, update checks and any feature that sends content.
3. Decide on cloud and AI features. Allow, restrict or disable SPSS AI Output Assistant, MATLAB Copilot and Online, Wolfram AI Access, JMP AI add-ons and cloud editions. If allowed for personal data, put a processor agreement in place [24].
4. Set defaults centrally. Telemetry opt-outs and update settings where the vendor allows, as MathWorks, Wolfram and Minitab document [9][18][19].
5. Check transfers. Note which vendors rely on the Data Privacy Framework or standard contractual clauses for licence and telemetry data.
6. Secure endpoints. Encryption, managed devices, approved storage, secure environments for sensitive data [29].
7. Tell users. Publish a short rule per product: what data classes, which features, where to store files.

Our vendor assessment guide covers the wider process, and the DPA checker helps when a cloud edition needs an agreement.

Sources

All sources retrieved 7 October 2026.

1. IBM Support, FAQs for SPSS Statistics Subscription.
2. IBM, What's new in IBM SPSS Statistics.
3. IBM Documentation, SPSS Statistics 32: Setting up your account (AI Output Assistant).
4. IBM, IBM Privacy Statement, updated 25 August 2026.
5. StataCorp, Privacy policy, last updated 16 November 2022.
6. StataCorp, License options.
7. StataCorp, Obtaining official updates over the internet.
8. MathWorks, Plan your Campus-Wide License deployment.
9. MathWorks, Help make MATLAB even better: FAQ.
10. MathWorks, MATLAB Online.
11. MathWorks, MATLAB Copilot FAQ.
12. SAS, SAS OnDemand for Academics.
13. SAS Support, SAS OnDemand for Academics: SASPy configuration (home regions).
14. SAS, SAS Managed Cloud Services privacy policy and SAS Privacy Statement, both revised 1 August 2026.
15. JMP, JMP Trust Center.
16. Wolfram, Activating products in Wolfram.
17. Wolfram, Wolfram AI Access Terms of Service.
18. Wolfram, Internet connectivity (Wolfram Language documentation).
19. Minitab, Privacy Notice, effective 15 August 2025.
20. JASP, Privacy.
21. JASP, JASP licensing (GitHub).
22. EViews, Registering EViews (EViews help).
23. MathWorks, Privacy Policy, last updated 25 March 2026.
24. European Data Protection Board, Data controller or data processor (SME data protection guide).
25. OsloMet, Software (student pages).
26. Copenhagen Business School, Open book exam: exam aids.
27. University of Jyväskylä, Ohjelmistot (software, in Finnish).
28. Wolfram, Wolfram Privacy Policy, effective 1 January 2023.
29. European Data Protection Board, Guidelines 01/2021 on examples regarding personal data breach notification, version 2.0, cases 10 and 11 and section 5.4.

About this page

Sources checked on 7 October 2026. We read each vendor's privacy policy and the product, licensing and AI feature documentation listed, plus EDPB guidance and university software pages. We did not install or test the software, so we describe what vendors document, not observed network traffic. Where we found nothing on a point, we say so; that is not evidence that a feature or practice does not exist. Product editions and AI features change quickly. This is general information for IT staff, researchers and DPOs, not legal advice, and not a verdict on any vendor. If you spot an error, please contact us and we will correct it.