Most times you see GDPR it relates to the first party storing data about their users, customers, whatever. I'm a developer for some hosted software (SaaS if you will) that allows —as a very tangential feature— users to store a personal address book of their contacts.
- Is that legal now?
- Do we have to consent every third party contact before they're added into the address book of one of our users?
- More worryingly, do we have to respond to personal data requests from contacts? For example, would we have to reveal who had added them to their address book?
We are within the EU, operating solely within the EU for now.