I have a website that is a travel search engine and I am very concerned about GDPR.

I am not interested in any private information from the users for marketing or such things. I just use Google Analytics to see the behavior on the page and to be able to improve it. No log-ins or accounts, no retargetting, no e-mail gathering, no newsletters...

According to GDPR:

‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

I have already anonymized the IPs for Google Analytics, so I would assume I do not have any personal data from the users anymore.

Is my assumption correct?

If so, do I need to care about all the clear explanations like where data is stored, how long is stored and so? Or can I just say something like:

"This website does not collect any personal data"


  • 3
    Does your webserver log it's requests?
    – wimh
    May 26 '18 at 20:34
  • 1
    If you do not process any personal data, the GDPR does not apply to you. In that case you do not even need add a note, but it won't hurt either.
    – wimh
    May 26 '18 at 20:57
  • It might anonymize the IP (xxx.xxx.xxx.0) and store it for maximum one day. After that, the anonymized IP is deleted.
    – J0ANMM
    May 27 '18 at 20:23
  • 1
    @wimh: "In that case you do not even need add a note" - do you have a citation for that? It would seem somewhat logical, but I feel I have read a large number of articles about the topic, and providing a privacy policy was treated as seemingly mandatory absolutely everywhere. Not a single time did I see a site mention the possibility that a website does not need a GDPR-compliant privacy policy. Aside from that, the idea that "but it won't hurt either" might be a bit careless. If "no privacy note" is a legal solution, having one might unnecessarily open an attack vector based upon ... May 27 '18 at 20:27
  • 3
    @O.R.Mapper Article 2 defines the scope of the GDPR. If you don't process any personal data, the GDPR does not apply based on that. However I am not sure whether a webserver really does not process any personal data, the requests an replies include an ip adress. Processing as defined in the GDPR includes any kind of operation, even deleting...
    – wimh
    May 28 '18 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.