Ask HN: How do you GDPR for your small side projects?

Email list needs to be updated - Only consented customer data needs to be stored, and erase the other unless you want a fine of 20 million euros or so. (remove data of those who have unsubscribed to your service immediately). Data erasure - Remove data of those who have unsubscribed to your service. Check for the Unsubscribe button everywhere - It’s mandatory that each and every mail of yours needs to contain an unsubscribe button with updated privacy policy given below. Update the privacy policy & terms of service - these need to contain what and how you are going to use the user’s data. For more info, read from the links given below in this answer. Double opt-in- for both entry and exit needs to be mentioned. Permission for profiling - Sales people can get prospective customer’s data through gated content(whitepapers, e-books) etc and they shouldn’t get this data from any other source like email hunters etc. (without their consent you can’t even breathe!) Employee data handling - You need to mention how and where is the data used and stored and for which purpose too. If you are using the data for multiple purposes, then you need to mention each purpose every time. Referral Program - You can’t process the referral email ids/data gained through offers/discounts etc. Yes, even they have to be GDPR compliant. Data usage policy - already mentioned in this answer(this is just to remind its importance in this context) Right to forget - option to be provided if the user wants you to erase(forget) their data from your databases. Usage of cookies - to track email opens etc you need to mention you are using cookies to the user. Some notes you would want to keep for GDPR compliance:

GDPR: Key Points and Steps to Prepare (https://www.agilecrm.com/blog/gdpr-key-points-steps-prepare/) https://www.superoffice.com/blog/gdpr-marketing/ (https://www.superoffice.com/blog/gdpr-marketing/) Salesforce PDF on GDPR(fiction vs fact) (https://www.salesforce.com/content/dam/web/en_us/www/documen...) GDPR Regulation (https://www.eugdpr.org/the-regulation.html)

https://gdprchecklist.io/

https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...

https://ico.org.uk/for-organisations/resources-and-support/d...

As an aside that checklist is misleading. Some of the requirements they list expressly don't apply to small businesses, for example you don't need a DPO unless you're over 250 employees.

1. aimed at, at the very least, medium-sized for-profit businesses, and as such include requirements that explicitly don't apply to very small projects

2. very often are trying to sell you something (consulting services, compliance audits, training, etc.) and as such are motivated to make GDPR sound as scary as possible.

There is a little more to it than this, but, my advice would be to just be mindful of any info you collect on users.

If you are worried about it, you can focus on projects that are open-access or don't necessarily involve accounts and login, but if you are implementing auth, just note what the auth collects, and be careful with it, both in terms of consent and securiy.

Don't give it to 3rd-parties (the easiest way to do this is doing things like sending userIds to Google Analytics in custom JS events). Consider whether your small side-project really needs Google Analytics (logging, crash analytics is good for debugging issues, but behavioural analytics is moving towards building a business, imo).

Note: I'm not implying side-projects shouldn't be moving toward building a business, but I'm just making the point that if that is your intent, you should be spending a little bit more time considering user privacy and compliance. And getting proper advice about it. You don't even need a DPO for <250 employees, so this really isn't that burdensome.