As title says, am I obligated as EU citizen / owner of website hosted in EU to log some data about users which would then make them identifiable? What if I do not collect any data about users of my website, can it be "illegal" in some regions, and could I get trouble for it as website owner/admin? What if I get request from police or other government agency to disclose data about my users / certain user and tell them I don't have anything?

2 Answers 2


There is nothing in the GDPR requiring you to collect individual personally identifiable information. If the website has no need, and the website owner no desire, to collect such information, there is no requirement to do so. The GDPR requires that if such information is collected, that there is a lawful basis, and that it be handled appropriately and stored securely, and deleted when there is no longer a need to retain it, or on a proper request. If no such information is collected in the first place, all the rules about how to handle it do not apply.

It is possible that some law of an individual country in the EU might mandate collection of some particular information, but I have not heard of any such requirement.

  • 1
    thanks for your answer, I think I wrote my question in kind of chaotic manner, but the point was I heared somewhere that in EU there (is / is gonna be) some law, called like anti terroristic act or something I can't recall and article was mentioning something about storing data about users so if they commit crime or are suspects or something, then they could be easily identified, maybe I overheared something or article was completely wrong Commented Jun 14, 2019 at 15:25
  • @stetoc I don't know what, if anything, such a law requires of a web site operator. i would have to try to look it up. Commented Jun 14, 2019 at 15:50

Nop... as David Siegel mentioned the option of collecting or not Personal Data from your website visitors is entirely up to you and should derive from the type of requirements that are inherent to your Service Catalog (meaning do you need their Personal Data to deliver your services; if not better not collecting anything (GDPR Principle of Data Minimization).

However if you decide you need to collect some Personal Data (Personal Identifiable Information has a not so broaden scope as Personal Data which is the definition under GDPR... just to clarify), you must document a Lawful Base (Consent; Legitimate Interest; Legal Obligation; other...)

So, if there was any Law in the EU that would oblige you to do so, the Lawful Base would be "Legal Obligation"... however, there is no such Law in any of the EU countries or at the central level.

In the case of terrorist threats or criminal behavior, the point of "search" will be the ISP and not your website, unless you have registered users, but in that case you already have their Personal Data and the entire question is pointless...


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .