4 ms·

> - How will I be able to operate my small company website in the future in a legally compliant manner? What exactly worries you here? If you could be more spe

> - How will I be able to operate my small company website in the future in a legally compliant manner? What exactly worries you here? If you could be more specific I'd be happy to try and answer your questions. > - How exactly does a privacy policy have to be worded The GDPR provides a list with the information that you need to provide to a subject when processing his/her data (also look at the other articles of the same section): https://gdpr.dpkit.com/gdpr/chapter-iii/section-2/article-13.html https://gdpr.dpkit.com/gdpr/chapter-iii/section-2/article-13... I think a simple text with clearly stated information is sufficient and I don't think that you'll get sued if you ensure that the information is accurate and complete, which shouldn't be too difficult for small websites. > - In which way will I still be able to store data for contacting my existing B2B customers (such as email addresses and phone numbers)? In a nutshell, you will need either their consent or a legitimate interest (as you do now as well): https://gdpr.dpkit.com/gdpr/chapter-ii/article-6.html https://gdpr.dpkit.com/gdpr/chapter-ii/article-6.html Communicating with your existing business partners (e.g. to inform them about new products or ask them for feedback) is a legitimate interest so you can still contact them without asking for permission first. They can tell you to not contact them again though (which isn't really new either). > - Will I still be able to use anti-spam and security plugins for my website? Yes, spam protection and security are legitimate interests and even required to comply with the GDPR (reasonable technical and organizational measures), so you are allowed to process and store IP addresses for that as long as the processing is commensurate (i.e. you should store the addresses for a limited amount of time and delete them as soon as you don't need them anymore). Here the GDPR is very similar to the BDSG as well in the sense that it allows processing of personal data if there's a legitimate interest, and ensuring the security and integrity of your service is a highly legitimate interest that can override many of the normal restrictions imposed by the legislation. Hope this clarifies some things, would be happy to hear about your other concerns / questions as well!

BjoernKW 8y ago
These questions aren't my own but rather examples of questions small business owners have been routinely - and legitimately - asking in discussion forums for months now. For the most part, these aren't tech-savvy people but entrepreneurs who maybe run a brick-and-mortar shop or a food truck business. If GDPR was that simple and clear these questions shouldn't even come up. There are a lot of people like yourself who try to help others but there's only so much we can do. I agree with everything you said on the matter. However, even lawyers, data protection experts as well as officials and high-ranking civil servants seem to disagree on at least some of these points, which doesn't really help with reassuring people.

BjoernKW 8y ago

These questions aren't my own but rather examples of questions small business owners have been routinely - and legitimately - asking in discussion forums for months now. For the most part, these aren't tech-savvy people but entrepreneurs who maybe run a brick-and-mortar shop or a food truck business. If GDPR was that simple and clear these questions shouldn't even come up. There are a lot of people like yourself who try to help others but there's only so much we can do. I agree with everything you said on the matter. However, even lawyers, data protection experts as well as officials and high-ranking civil servants seem to disagree on at least some of these points, which doesn't really help with reassuring people.