> Does there need to be some GDPR compliance thing? Yes. GDPR is about data protection. If you want to do business in its jurisdiction, then you need to know t

> Does there need to be some GDPR compliance thing? Yes. GDPR is about data protection. If you want to do business in its jurisdiction, then you need to know the laws. In general, GDPR states that you cannot store anything that isn't strictly necessary, unless you outline what you want to collect and what it will be used for in your data policies. You are not allowed to use it for anything else and once its no longer needed for the outlined use, it must be removed. Personally identifiable information has some additional rules (and its important to note that anything could become PII if combined with something else, that would, together, allow for someone to be identified). My own (EU-based) country's data protection websites states: 1. Everyone has the right to the protection of personal data concerning him or her. 2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned, or some other legitimate basis laid down by law. 3. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified. 4. Compliance with these rules shall be subject to control by an independent authority. This means that every individual is entitled to have their personal information protected, used in a fair and legal way, and made available to them when they ask for a copy. If an individual feels that their personal information is wrong, they are entitled to ask for that information to be corrected.