I have a website hosted in a European server. The website is static (serverless) so I can take advantage of a CDN to serve its whole content.
A CDN is, basically, a distributed network of servers. That means that a copy of my website would be hosted on several servers around the world. User requests are (ideally) directed to the server which is closest to the user. By doing so, a CDN improves the performance of the site.
How is this relevant concerning the GDPR?
By using a CDN I'm adding to the system a new third-party that will collect the IP and other metadata from my users. Obviously I can't get consent from the user beforehand: when they hit the server it is already too late.
Probably, users will get routed to a server close to them, but this is not guaranteed. I don't know to which server they are going to connect. I don't even know the country. It could be that a German user end up sending his IP, browser footprint, etc. to a server in Japan (unlikely but possible). Because I don't know it, I can't inform the user about it.
My assumptions are:
Without CDN, the hosting provider would collect that same data so I don't think there is a relevant difference. I just need to inform my users in the privacy policy which CDN provider I use and that it collects personal data on the basis of legitimate interests (Art.6(1)(f)), as I do with the hosting provider.
Because there is a potential transfer of personal data out of the EU, I must ensure that the DPA that I sign with the CDN provider includes the SCC. Also, I must inform the users about this possible data transfer in my privacy policy.
Are my assumptions correct?
Is there, in the frame of the GDPR, any other aspect to take in consideration when using a CDN?