That depends on the legislation in your country (which may include international agreements to abide to other countries' data protection laws). But you should b

That depends on the legislation in your country (which may include international agreements to abide to other countries' data protection laws). But you should be fine with these main provisions: Data privacy policy: offer a data privacy policy which explains which data is processed (collected, stored, processed), for which purpose and how a user can request data deletion. State clearly when data cannot be anonymised (eg. email for user login). Make sure to include 3rd party data processors (eg. google analytics). Purpose: process only the data needed, don't process data because it might be useful in the future Identifying data: where such data identifies a single person, anonymise it (eg. blank out the last part of the IP address) Retention: aggregate and anonymise data as soon as possible, delete the raw data once it stops being useful