3

Most times you see GDPR it relates to the first party storing data about their users, customers, whatever. I'm a developer for some hosted software (SaaS if you will) that allows —as a very tangential feature— users to store a personal address book of their contacts.

  • Is that legal now?
  • Do we have to consent every third party contact before they're added into the address book of one of our users?
  • More worryingly, do we have to respond to personal data requests from contacts? For example, would we have to reveal who had added them to their address book?

We are within the EU, operating solely within the EU for now.

Improve this question

1 Answer 1

Reset to default
1

In this scenario, you are a processor, not a controller. (see Art. 4 (8) GDPR) (obviously you may well be a controller too)

Is that legal now?

Yeah, if you comply with all the obligations, especially Art. 28 GDPR. Note that your processor relationship needs to be defined in a contract (like a Data Processing Agreement, which is referenced in the controller's privacy policy)

Do we have to consent every third party contact before they're added into the address book of one of our users?

If a user (a company or even a natural person) uses your product's address book feature to keep track of contacts, they are the controller, and this would be covered under the DPA. (here's an example of one of those). Also, consent is only one of the possible ways to lawfully process data (see Art. 6 GDPR)

More worryingly, do we have to respond to personal data requests from contacts? For example, would we have to reveal who had added them to their address book?

If you want to be helpful, you can refer the subject to the actual controller. You only need to respond to subject access requests if you are actually processing personal data, and it sounds like you're not doing that here.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .