2

We are developing software that are sold to and used by other companies. In the software, certain types of personal data, like name, email and phone number, can be stored when a user registers. The data is stored on a server owned by our customer. Our customer owns all the data. Our software shows this data in certain places within our software itself, but does not share it with any other third parties, or store it on our own servers, or use it in any other way.

What are our requirements when it comes to providing a privacy policy for our software, to be compliant with GDPR? Will our software only be considered a tool used by our customer in which they collect personal data, and hence not require us to have our own privacy policy accepted by the users in addition, or will we have to have a privacy policy explaining what personal data which our customer is able to collect through our software?

All users of the software will be employees of our customer, if that makes a difference. They will therefore have their own privacy policy agreement with our customer (their employer) already.

Improve this question
3
  • 2
    I don't know enough to offer an answer, but can you clarify something please: My reading is that any personal data is collected after you supply the software to the customer, not before. So once delivered, would you have access to it?
    – user35069
    Aug 10 at 12:16
  • 2
    We, as persons, will not have access to it, unless our customer provides us access, but in that case I guess that will be like the customer providing anyone else access, and no longer have anything to do with our software. On the other hand, our software which is running at our customer has access to the data (but won't send it to us or do anything else with it, except for displaying it within the application itself).
    – Mr. Eivind
    Aug 10 at 12:22
  • 1
    Again, I don't know for sure (so don't rely on anything I say!) but it seems that if you are not processing pii then you don't need to worry - but I'll leave it for others with experience and knowledge to answer
    – user35069
    Aug 10 at 13:16

1 Answer 1

Reset to default
7

Alice's business sells database management software.

Organisations buy or licence the software, deploy it on hardware they control and use the software to help store and, process and analyse 'personal data' within the meaning of GDPR.

Alice's business has no access whatsoever to the personal data being stored and processed by those organisations.

In respect of that personal data, GDPR is not engaged by Alice's business. The business is neither a 'controller' nor 'processor' of that personal data.

Who does the data protection law apply to? - European Commission

Who does the UK GDPR apply to? - Information Commissioner's Office

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .