Privacy obligations, in context.

GDPR information

Sky is based in India and serves the United States, EU/EEA, United Kingdom, Canada and India. The EU General Data Protection Regulation (GDPR) may apply depending on the processing activities and territorial scope in Article 3. Applicability must be assessed for the facts; this page does not assert that GDPR or every other privacy law applies to Sky or a visitor, and it is not a legal conclusion or certification.

What an operational review needs to establish

• Scope and processing inventory (Article 3). Identify the relevant establishment, activities, people and territorial connections before deciding which legal rules apply.
• A lawful basis for each purpose (Article 6). Document the basis that applies to each processing purpose and its supporting facts. GDPR does not always require consent for marketing; consent is one possible basis, and other applicable rules may impose separate requirements.
• Clear, complete information (Articles 12–13). Provide transparent information about the controller and contact details, purposes, lawful bases, recipients, retention, rights and other required matters in an accessible form. Sky has confirmed its business name, Indian establishment, business postal address and designated privacy contact. Processing purposes, lawful bases, controller/processor roles and the remaining required notice information still need operational and legal review.
• Rights handling, including marketing objections (Articles 12 and 21). Establish how requests are received, verified, routed, decided and recorded. A person may object at any time to processing for direct marketing; that processing must then stop for that purpose. Where GDPR applies, Article 12 generally requires action without undue delay and a response within one month. A permitted extension of up to two further months must be explained, with reasons, within that first month. This statutory description is not a Sky service-level promise, and this page does not submit or automatically process a request.
• Processor arrangements (Article 28). Where a vendor acts as a processor, assess the role and put the required documented terms in place, including applicable subprocessor controls. Vendor names or technical connections alone do not prove adequate contracts.
• Security appropriate to risk (Article 32). Assess and document appropriate technical and organisational measures, considering the nature, scope, context, purposes and risks of the processing.
• International transfers (Chapter V, including Article 44). Map relevant transfers and confirm an applicable transfer mechanism and safeguards where required; review vendor locations, access and onward transfers.
• Retention, deletion and incidents. Define and evidence purpose-linked retention, deletion execution, and a breach-detection, assessment, escalation and response procedure. A published notice or a technical safeguard does not show that these operations work.

Controls are not a complete compliance finding

Sky has technical controls such as optional multi-factor authentication for enrolled accounts, host-only authentication cookies, and optional consent gating for Sky-managed analytics. These are relevant security or preference controls, not proof that all GDPR requirements are met. The cookie review is incomplete: separately loaded hosting analytics and external resources are not shown to be controlled by Sky's optional consent gate. Cloudflare Turnstile, if enabled on a form, is a bot-check control, not a GDPR certification.

GDPR, EU/UK electronic-marketing rules and EU/UK rules on cookies or similar technologies are distinct legal regimes and may impose separate requirements. Their application depends on jurisdiction, audience, technology and activity. Marketing consent is not universally required by GDPR itself, and GDPR does not require every organisation to appoint a data protection officer in every circumstance. Those questions need a fact-specific jurisdictional review.

Making an inquiry

For information about Sky's described data handling, read the privacy notice. Existing options include email preferences, California privacy choices and the cookie policy. You may email privacy@skyteknologies.com with a question. This page is not a rights-request form and makes no automatic submission or separate deadline commitment by Sky.

Source: Regulation (EU) 2016/679 (General Data Protection Regulation), EUR-Lex.