Have a few doubts for GDPR law. If we are a mobile app, that allows user to store data inside our application like photos, videos and notes etc then do we have to get user content or anything related to GDPR.

example : a vault app.

Also, if the user is storing the data in our app but the data is not encrypted then do I need to encrypt data even if we do not fall in GDPR ?

  • To answer this, we need to know what processing you do. If you supply a vault app that stores data on the user's device and only the user has access to this data, you are not processing personal data, so the GDPR does not apply to the app. – Free Radical May 16 '18 at 8:29
  • Yes we are not processing the data we only store the data for the user and apart from the user no one else has the access to it. Also, the data stored is not encrypted so does the GDPR applies as to we have to encrypt the data or anything like that ? – Frank May 16 '18 at 9:24
  • 1
    @FreeRadical I think that point on processing is debatable - under GDPR, storing data IS processing it. see my answer – David May 24 '18 at 12:50
  • @FreeRadical sorry, I was still writing it up! I take your point, but he said "If we are a mobile app" - I would take that to mean his company is, at the very least, gathering, storing and erasing data, which counts even if performed locally and not transmitted to the company themselves, I believe. – David May 24 '18 at 12:59
  • 1
    @David. The answer to a "who"-question must be some human entity, not some computer application.The "app" can by its very nature not be the controller of this personal data. The apps legal owner can't be controller either, unless the apps legal owner controls the data (that follows from the GDPR defintion of "controller"). IBM is not the controller of personal data processed by IBM's customers. – Free Radical May 24 '18 at 13:42

Assuming the data is only stored on the users's device, (as mentioned in a comment), the GDPR does not apply to the developer of an application.

It could however apply to the user who uses the application. But the question seems to indicate it will be for private use only, the exception in Art. 2 (2)(c) GDPR would apply.

  1. This Regulation does not apply to the processing of personal data:

    (c) by a natural person in the course of a purely personal or household activity;

If the GDPR would apply, for example because it is used by a company storing photos of customers, it would be the responsibility of the user to comply with the GDPR. If the application is not GDPR-compliant, the user would have to stop using the application.

| improve this answer | |

if the user is storing the data in our app but the data is not encrypted then do I need to encrypt data even if we do not fall in GDPR?

This reply assumes that you are doing some of the processing and/or storage, as opposed to leaving it all on the user's device.

The GDPR does not directly mandate encryption. Article 32(2) says:

In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.

So you need to think about how sensitive the data is likely to be. Then design your data processing and management practices (e.g. which employees have access, what procedures must they follow) accordingly.

So the upshot of all this is, no you don't have to encrypt the user's files, but doing so might well be a good idea.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.