I'm planning on making a website to act as a CV / portfolio of my work as a software developer. I intend to lock this personal data behind a token based access system, so that it isn't available unless someone sends me their email address. Their email address will be stored against a token which is emailed to them, and that token both grants access and allows me to audit access to my personal data. I intend to encrypt the email address and keep the decryption key separately from the server so a data breach should be mitigated against. Do you think GDPR applies to me in this situation and, if so, can I protect or indemnify myself somehow?

2 Answers 2


The GDPR applies to all data controllers, regardless of whether the data controller is business or non-profit, corporation or natural person. However, there is an exception for purely personal or household purposes.

A CV page comes fairly close to a purely personal purpose, but I don't think this exception would apply: you are not just processing the personal data from family members or close friends, but from members of the public.

If GDPR applies, you need a legal basis for processing personal data. Presumably, you will have to articulate some legitimate interest (Art 6(1)(f)) that outweighs the visitors privacy interests. Per the GDPR's data minimisation principle, you can only process the minimum data necessary to achieve the purpose of processing so you will have to find a good reason why auditing access to your portfolio is so important. Don't forget to provide a privacy policy that conforms to GDPR Arts 13–15, and to prepare for data subject requests such as a right to access or right to erasure.

Perhaps it is simpler to consider alternatives. For example:

  • keep a portfolio public, but only send your full CV out manually. Sending out your CV in course of a job search sounds like a purely personal purpose.
  • use a social media or job platform where you're not the data controller
  • Thanks... I'll look into specifying a privacy policy as indicated... Ironically the audit is to stop my own personal information being abused by recruiters, or more correctly to identify who has sold / passed my personal information on, so I need something to identify who has read my site. Jun 21, 2020 at 10:44

No, the GDPR does not apply unless you're under the GDPR's jurisdiction. That's the European Union plus anyone or organization with a legal nexus in the EU. So, if you're not in the EU and your server and the entity (company, etc.) that has the server is not in the EU, you probably don't have the nexus.

Nexus includes citizenship in the EU and, for a corporation or other entity, some kind of charter, registration, etc. in the EU even if the headquarters and all offices are elsewhere.

While the EU would like the world to believe that the GDPR has worldwide jurisdiction, this is not legally possible. The U.S. cannot have a law taxing everyone in the world and 192 other nations also can't have laws taxing everyone in the world, or you'd have to pay taxes to 193 nations and maybe go to 193 jails if you don't pay.

The fact that someone in the EU can see your website, interact with it over the Internet, and send you an email address that is hosted in the EU is, by itself, not enough of a nexus for you.

Whoever you use for your hosting likely has terms of service. Read them carefully to see if that hoster requires GDPR or EU compliance. Some big American companies have the nexus and if you use their servers you have to agree to GDPR. Even if you have your own dedicated server but it's run by a hosting service, if that hoster is under GDPR, so are you.

There is, by the way, no way that someone who has to comply with the GDPR does not have to comply with all EU law, and that brings up all of the other EU laws that might apply. If you have to litigate under EU law and you're not there, plan for the airfare.

(Originally, a moderator answered that the answer is Yes. That is partly what this No answer responds to, but I don't know why that other answer disappeared.)

By the way, your procedure might give you a clue if the re-user is a visitor of yours but not if they sell or transfer it. It might also discourage people you want seeing your CV from taking the extra step and therefore from seeing yoour CV. People can be picky that way. I think about who I give my email address to and whether the benefit is important enough.

  • 2
    I like your analogy with tax law, as US tax law applies globally to all US citizens. In a similar vein, the GDPR also applies globally, to everyone who processes personal dat from EU citizens. If you want to be able to ignore the GDPR, you must avoid processing personal data from EU citizens, but you can't avoid it by changing your location. Jun 23, 2020 at 11:11
  • I'm in the UK (I probably should have mentioned this in my question) - which, at the time of writing, is still in the EU, and I shall be hosting this myself, so no need to worry about hosting terms and conditions. I'm not struggling for Job offers so if I put people off, who are unwilling to provide an email address, I'm fine with that, it's hardly a aggregious step to take when looking at candidates, and if someone is that lazy - I don't want them as my boss. Jun 24, 2020 at 8:13
  • Each email address entered by recruiters, will be linked to a unique email address of mine, so I will be able to identify who passes on any email address of mine (At least the source of the data leak will be identifiable, even if it propogates much further) FYI the reason the other post disappeared is possibly because I reported it for being flippant and not useful. Jun 24, 2020 at 8:13
  • @bart-van-ingen-schenau: US taxes US citizens globally, not Russians in Russia. Someone without in-EU presence/nexus/citizenship (I added citizenship to my answer) can process EU citizens' data & not comply with GDPR because EU has no jurisdiction. If he weren't in UK, he can move all he wants outside of EU and ignore GDPR. Another analogy: Saudi Arabia or Iran might like global jurisdiction to make everyone join their religion, but the nations don't have the right.
    – Nick
    Jun 24, 2020 at 17:39
  • 1
    @Nick bart-van-ingen-schenau is correct - legally speaking the GDPR claims jurisdiction over EU data subjects and EU courts will behave as if it does. See Article 3. You are incorrect. It's a different matter whether there is an effect in practice, indeed in these particular circumstances.
    – Lag
    Jun 24, 2020 at 18:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .