39 ms·
GDPR compliance for indie developers is a little painful, but completely doable. The core principles are that you collect as little personal data as possible, h
by gizmo 7y ago
GDPR compliance for indie developers is a little painful, but completely doable. The core principles are that you collect as little personal data as possible, have an expiration policy for all data, and don't share personal data with 3rd parties that don't themselves abide by GDPR. If you do these three things you should be OK, assuming you don't collect the most sensitive data.
GDPR isn't meant to bully people who make a good-faith effort to deal with customer data responsibly, and GDPR isn't enforced to destroy those who don't comply perfectly. In the US prosecutors will mercilessly enforce the letter of the law for a few unlucky nobodies to set an example for the rest. In the EU it doesn't work like this.
- Mirioron 7y ago>In the EU it doesn't work like this. Yep, it's much more selective in the EU. As long as you are in the good graces of those in power everything will be fine. If you aren't...
- ahartmetz 7y agoThe level of corruption is fairly low around here, thankyouverymuch.
- tzs 7y agoFor indie developers not in the EU but with users in the EU, what's a good way to deal with Article 27's requirements [1]? [1] https://gdpr-info.eu/art-27-gdpr/ https://gdpr-info.eu/art-27-gdpr/
- latk 7y ago1. Many indie developers will not actually be subject to the GDPR. The GDPR effectively only applies to non-EU controllers if they are actively targeting and expecting EU users, or if they are monitoring/tracking users in the EU. The canonical reference to when that's the case is the EDPB Guideline 3/2018 on the territorial scope of the GDPR [1]. These guidelines are more narrow than widely perceived, e.g. that regional US news websites started blocking EU visitors is totally silly and unnecessary. Mere accessibility of a service, without offering the service to persons in the EU, does not trigger the GDPR. 2. If the developer does expect to be subject to the GDPR, they can hire a representative. There are many lawyers offering this service. It's not a terribly involved job, but it affects which member state's data protection agency is responsible. E.g. if you think Austrian GDPR interpretations are nuts, go look for someone in Ireland instead. [1]: https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32018-territorial-scope-gdpr-article-3-version_en https://edpb.europa.eu/our-work-tools/our-documents/guidelin...
- drstewart 7y agoHow is "this policy probably won't be enforced so don't worry about it" in any way a reasonable approach?