Ask HN: How can I comply with GDPR as a solo founder?
I am based in the USA, and am hard at work on building services for my company. My goal is to launch and have customers by the end of the year.
While I 100% support GDPR, I do not know anyone within the EU who could act as a Data Protection Officer or EU representative for privacy concerns. I am funding myself at this point, and don't really want to shell out hundreds of dollars to some law firm just because they have an address within the EU. Outside the EU, I plan to handle support concerns on my own (for the time being).
What are my options here? My initial thought is that I will just have to prevent those living in the EU from using my service, which is unfortunate.
An open Ask HN community consultation from 2019 where @sjroot convened hundreds of developers and bootstrappers to share real experiences, hard numbers, and tactics.
Hundreds of active indie hackers contributed case studies, pricing heuristics, and pitfalls to avoid when moonlighting on side projects.
It's a great question and one of the common complaints to the wave of privacy regulations. I believe that it's not a ton of work, but may be a bit of legalese to wade through and should be basic due diligence for collecting personal information.
There is a lot in GDPR, but here's a list of possibilities that will honor the spirit of the law and be huge steps forward:
- Privacy policy: Write a human-readable privacy policy and publish it. It should declare what you collected, for what purposes, how long it's retained and how to contact the privacy office for data subject requests.
- Conduct an internal Privacy Impact Assessment: an inventory of personal data collected, for what purpose, what is it's risk/danger level, what lawful reason is it collected/processed, where is it stored and what is the retention policy.
- Lawful processing: For each of the types of data collected, determine the lawful umbrella for collecting and processing it; GDPR defines a bunch but most people use only "legitimate interest" or "explicit consent". If you need to use consent, find a vendor to help you manage it.
- Honor data subject requests for access/portability/erasure. Doesn't have to be fancy, can even be just a mail to privacy@yourdomain. Don't forget to authenticate/vet the requestor to avoid leaking data.
- Vendors/3rd party companies you use: Inventory them and record what data is going to them. Will likely have in contracts their obligations under GDPR, and will define their role ('processor' or 'controller').
The Data Protection Officer doesn't need to be located in the EU. You may also not even need to appoint one, depending on what exactly your company does.
You should read through the following sections of the GDPR carefully, especially Article 37 to determine if it seems to apply to you (the requirements are vague, but you should at least be able to get a general idea of whether it seems to apply to you or not):
Article 37 - Designation of the data protection officer - https://gdpr-info.eu/art-37-gdpr/ ↗
Article 38 - Position of the data protection officer - https://gdpr-info.eu/art-38-gdpr/ ↗
Article 39 - Tasks of the data protection officer - https://gdpr-info.eu/art-39-gdpr/ ↗
Recital 97 - Data Protection Officer - https://gdpr-info.eu/recitals/no-97/ ↗
On a technical level: have a process for gathering and sending responses to requests from EU users for their data. Have a process for being able to hard delete that data, and a user's account. Dont store anything you dont need, not even in logs (IP addresses), and dont send that data to third party providers. Don't use third party monitoring, and analytics services that aren't GDPR compliant. Keep a constantly up to date document of cookies your site uses, and whether they're essential or non-essential for your product/service to operate. Lastly, learn exactly what is considered PII and not. This is a non-exhaustive list of things you should start with, and then go with common sense, and legal counsel as you can begin to afford it.
Edit: Following up, I say on a technical level, because much of this you can do yourself via having some scripts and report generation in place.
You most likely don't need a DPO: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/do-rules-apply-smes_en ↗
Check out the rest of the website, it is pretty helpful.
Don't worry too much, GDPR is both common sense and designed do go after the big companies. Some rules are intentionally vague in order to be hard to circumvent using armies of lawyers and/or technical 'innovations' in exploiting personal data.
As a solo founder, don't worry about it.
hundreds? LOL! $10,000 to get a DIY kit.
From one of your replies:
This isn't possible with a one-man company. Rather, it's possible to tell them you are (there is no certification body) but it's not possible to be compliant if you don't already have expertise.
I don't know why others are mentioning a DPO. You won't need a DPO.
The easiest route to compliance is to not collect Personal Data.