The past few months I've been working on a website which allows users to manage family trees, write stories about the family etcetera. Now the last few days the GDPR has come to my attention. This is mainly a hobby project (started working on it for my grandmother) but I want to make it available to the general public.
Before I put way too much effort in to the website I was wondering how this project is going to be affected by the GDPR.
The data the user inputs is only searchable, editable and removable by the person who creates the family tree and the users that are invited to do so by the creator. Using this system (and most genealogical systems) the user is able to input data about people who are still alive and have no knowledge of this.
As I understand, officially the person creating the family tree should have permission to enter the data from the people that are still alive, but in practice I fear that is not always the case.
From what I understand of the GDPR with my limited knowledge about the subject the processor
(in this case the website) has to ask permission from the people of which it stores the data, but who is that in this case?
Is it enough to ask permission from the user inputting the data and inform them that they should have permission from the persons they are entering the data of?
If not, I am a bit lost on how to handle the GDPR in this case, it is next to impossible to get the permission of all the living people that are being added the family trees.