Ask HN: What do I need to do to make my blog GDPR compliant?

--Not Legal Advice

Trying to avoid google analytics personally, but as you added them to your site you need a policy. You are the custodian and are sharing information to google through you. As you are the Data Controller: https://www.gdprsummary.com/gdpr-definitions/data-controller....

https://piwik.pro/blog/is-google-analytics-gdpr-compliant/#2...

Depending on the information logged by your nginx server, you may also need a policy. IP for instance is one thing you might need to cover.

That link says “ Any business in the world that collects personal information from people in the EU (even if it's just an IP address) will be required to comply with the following General Data Protection Regulation (GDPR) Privacy Policy stipulations” but I am not a business. So can I assume it doesn’t apply to me?

Google Analytics and Logs are bad /o\ (as in compliance stuff).

If you have readers in the EU and/or you are living in the EU, you are required to have a privacy policy.

This (https://www.iubenda.com/en/help/8385-gdpr-for-bloggers) article and this (https://adventurebagging.co.uk/2018/05/gdpr-guide-for-blogge...) is looking like a good read.

You could also be required to have data processing contracts.

Some local privacy protection offices have good information about GDPR for small blogs and sometimes you can even ask them directly.

no legal advice

You mean this one? Seems to be spam/trolling/whatever.

    My name is #REDACTED#, and I am a resident of Roanoke, Virginia. I have a few questions about your process for responding to General Data Protection Regulation (GDPR) data access requests:

    Would you process a GDPR data access request from me even though I am not a resident of the European Union?

    Do you process GDPR data access requests via email, a website, or telephone? If via a website, what is the URL I should go to?

    What personal information do I have to submit for you to verify and process a GDPR data access request?

    What information do you provide in response to a GDPR data access request?

    To be clear, I am not submitting a data access request at this time. My questions are about your process for when I do submit a request.

    Thank you in advance for your answers to these questions. If there is a better contact for processing GDPR requests regarding 2uo.de, I kindly ask that you forward my request to them.

    I look forward to your reply without undue delay and at most within one month of this email, as required by Article 12 of GDPR.

You need to have a privacy policy, legally (nobody will really care if you're just having a private blog). Take a look at mine: https://www.2uo.de/privacy/ (but this is without GA).

If you have server logs and Google Analytics, you'd write that you need the logs for problem debugging and Google Analytics to improve your web site. Both are legitimate interests, and you don't need any kind of pop-up or so.

Removing GA is a good idea anyway, if you don't really use it (like most small private blogs who implement it, just because it's easy – I used to do that, too).