I have written an android app The user does some HTTP requests do an endpoint and gets data, also the user can download images to his own storage. But I don't collect any data from the user?

Is is mandatory for the dev to include the GDPR although he doesn't collect data?

If so, what?

  • 1
    Does the service you are calling log IP addresses or anything like that? If so, that's GDPR fodder right there. – user4210 Aug 6 '19 at 8:16
  • @Moo I am not sure if it does, I think so (It`s not my own service) so Is that the only thing I have to add in my GDPR? – Alan Aug 6 '19 at 8:23

Any website or app potentially has access to personal data. You decide how this data will be processed, so you are a Data Controller and must comply with the GDPR This includes obligations such as providing privacy policy style information and assessing potential risks for your users.

If you are not using any of the data you have access to, that makes compliance very easy. Where you share data with third parties (such as by making HTTP requests) that is already a bit more complicated. Who runs that endpoint? Under what legal basis can you send them data? Does this count as an international transfer? What will they do with personal data? How do you protect the connection, e.g. by using HTTPS?

In practice this is still fairly simple, but compliance is not zero effort.

  • Https yes, endpoint is IG, there is only called a link and you get a JSON element, yes international. I have seen many pages where it is possible to generate a GDPR is that save? – Alan Aug 6 '19 at 12:35
  • @Alan You keep saying "a GDPR". That is wrong. GDPR stands for "General Data Protection Regulation". It has been created by the EU, and there is no way for you to create or change it. I think you mean "a consent form as required by the GDPR". Note that "consent" is only one of the ways that processing of personal information can be permitted. – Martin Bonner supports Monica Aug 6 '19 at 13:46
  • @MartinBonner thanks for englightening me, you are right – Alan Aug 6 '19 at 13:48
  • 1
    @Alan those automated privacy policy generators are generally fine, except that they do not take your specific situation into account. The ICO has this checklist. Some parts you can take from other privacy policies, but there's a lot of stuff you should do yourself. – amon Aug 6 '19 at 19:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.