1

(this is the closest StackExchange site I could find, even so, I'm sorry if the Q is still a bit out of place).

So, I've just finished building an application for better handling some of my needs and responsibilities. Eg. I have a billing module for issuing invoices, keeping records of my finances, etc. This software is solely for my own personal use, there is no way I will ever give anyone access or source codes to run their own instances. Now, the backbone of this software is obviously a comprehensive database with such records as people and companies.

And I wonder, how legal this technically is? This database obviously contains a lot of personal information/data, information entered exclusively by me. This information is accessible only by me, it's not and will not ever be used for any commercial purposes (I won't ever sell the information itself, nor the information metadata).

So, am I technically breaking any laws/regulations just by having such software?

For instance, intuitively it seems to me that having a directory with people, their phone numbers, emails, addresses, etc. clearly breaks GDPR rules. However, on second thought, this is precisely what the contacts app on my phone is - a directory of people with their personal information. So is this the same thing, or does the exact same concept break different rules when it's implemented in the phone vs. custom software?

Improve this question

1 Answer 1

Reset to default
2

It is not illegal to have such software. The question is how you use it. Some uses of your phone's contact app can be a GDPR violation as well.

The GDPR has an exemption for “purely personal or household purposes”. When an ordinary user uses some software for managing their personal or family life, that is not subject to GDPR. E.g. I have a contact list with friends and acquaintances and that is not subject to GDPR at all.

You are mentioning invoices. Issuing invoices is not a purely personal activity. It affects people outside your friends and family. Your understanding of the term “personal” (the software is custom-tailored for your needs) is different from the GDPR's concept of “purely personal”.

With respect to processing activities that you perform e.g. as a freelancer, you must consider the GDPR. For all such processing activities, you need a legal basis. For invoices this is simple because you're legally required to issue correct invoices. But if your software has aspects of a customer relationship management system, things would be a bit more tricky. The GDPR offers a choice of legal basis, but here there might be a “legitimate interest” to keep track of people with whom you have a business relationship. But it is not the features of the software that are relevant here, but which processing activities you're going to carry out with that data via the software. Mere storage of information is already a processing activity in the sense of the GDPR, though.

If you're using the same systems for purely personal activities and business activities, it might be difficult to understand your obligations with respect to your data. If possible, it is best to keep your private life separate from business activities so that no confusion arises. For example with a contacts app, it could make sense to use different user accounts for personal and business use.

Typical GDPR issues with a contact information database could be:

  • not having a clear purpose for which this data is being stored and used
  • storing the information for longer than necessary
  • storing information about people with whom you do not have an appropriate relationship
  • sharing the data with others, without a proper legal basis
  • unsolicited marketing to people, though some kinds of direct marketing are allowed by the laws in your country
Improve this answer
1
  • Thank you! A clear explanation that makes sense.. 👍😊
    – user43325
    Commented Jan 1, 2022 at 23:01

You must log in to answer this question.