Botnet research is one of the many research areas affected by the coming into force of the
General Data Protection Regulation (GDPR). This article aims to identify the most
appropriate legal bases that would legitimise data processing in the context of botnet
tracking and to give an overview of the practical implications for practitioners. First, we give a
technical introduction to botnet tracking techniques and the types of processed data.
Afterward, we argue that botnet tracking qualifies as” processing of personal data” and falls …