gdpr
GDPR Privacy Policy - how to handle non standard cases without much budget
<p>I want to market a little side hustle of mine and due to GDPR need to create some data privacy policy. Since as any reasonable developer I try to leverage the power of frameworks like Firebase, Stripe, DallE2, other Google Services etc it seems like at the free privacy policy generates are not applicable.
I checked and found IT lawyers to charge 200 - 450 EUR a single hour which is simple unreasonable and unacceptable.</p>
<p>I mean I really don't try to screw anyone but the hurdles I see here seem insane.</p>
<p>Options I see:</p>
<ul>
<li>hire someone from fiverr to create that for me that is not a lawyer but has good reviews? Not sure how much of a risk reduction that really is. Seems a bit like a gamble.</li>
<li>Alternatively I could create a 1 EUR company that in case of being sued I essentially close and have no liability with my private money</li>
<li>open the company remote in a coutnry that doesn't care about such in my eyes overkill nonsense</li>
</ul>
<p>I really wonder how to approach this without spending thousands of EUR on legal services or is that basically not possible in the EU anymore?</p>
<p>Cheers
Tom</p>

<p>If you want some boilerplate text to just drop in and have done, you are going to be disappointed. But you don't need a lawyer either. Treat it as a coding job. First, list all the ways you are going to store and process identifiable user data. If someone is going to process it on your behalf, identify them too. Draw a chart showing the paths that user data is going to take. (Storage is a form of processing)</p>
<p>Then look at the 6 bases for processing user data and figure out which ones apply to each step. E.g. if the user asks you to do something then that is one basis under which you can process their data. See how much coverage you can get without asking for consent.</p>
<p>For each third party (e.g. Google) figure out what data is to be sent to them, and where they will be. Google has data centres in the EU specifically so you can get them to process user data without sending it outside the EU.</p>
<p>Check the third party contracts for these services, including the confidentiality clauses. Link that to the processing they will do for you.</p>
<p>Finally, pull all this together into a single summary of what you are going to do with the data and the bases under which you will do it.</p>

<h2>No one is forcing you to run a business</h2>
<p>If you <em>choose</em> to do so, you are <em>obliged</em> to comply with the law.</p>
<p>Complying with the GDPR (among many other things) is simply a cost of doing business. If that costs so much that the business is unviable, don’t run the business.</p>

<p>I have seen many people on this platform, utterly clueless about the practical parts of the GDPR. I guess they deal in law theoretically, not in actually bringing an App to market. And that is fine, that is what this site is about.</p>
<p>So please, do not write that up yourself. Either get educated about the GDPR beforehand. Which you <em>should</em> already be, if you were an App developer through your day job. Because those trainings are mandatory, company wide, in many juristictions where it applies, how else would the company comply with laws? Or, get a lawyer. Serious companies do <em>both</em>.</p>
<p>A lawyer is not as expensive as you think. Per hour, they don't cost much more than a senior developer. Just for starters, to comply with the GDPR you need to show terms of service, saving which version which user agreed to, showing and prompting for agreement if the latest hasn't been signed, allowing the user to self-delete their account allowing the user to know which data has been saved on them by you. All of this has to be automated, if you don't want to be hit by a lawsuit later. Because there are legal deadlines, and you don't want your side hustle to be something that you cannot leave unattended for a weekend.</p>
<p>So assuming a senior developer at roughly the same rate as a junior lawyer actually implements just the neccessary minimum, you are looking at 20, maybe 30 hours of work if done well. Obviously you can always do a shitty job in less, but lets assume you do it looking good in the UI, well tested and reasonably bug free and secure.</p>
<p>After investing 30 hours just into the GDPRs practical implementation, hiring someone for a few more hours to write up the terms of service, seems pretty reasonable.</p>
<p>I <em>strongly</em> advise you to educate yourself on this topic. Because there are details that a lawyer <em>knows</em>, but since they don't code or look at your source, will never be able to warn you about properly.</p>
<p>As an example, if you use Google fonts from a CDN, you have already breached the GDPR. And you have not even programmed the first screen yet. Obviously the fonts will be loaded from the CDN before the user can agree to any terms, displaying the text of the terms needs the font. So before the user has had even the chance to consent to anything, you have already leaked their IP address to a third party. Because that is what technically happens, the CDN gets to know the user's IP address, because your app made it available by calling it from the users device. To comply with the GDPR, the font has to be packaged with your app or loaded from your own backend server, not loaded from a CDN.</p>
<p>A lawyer could tell you that, if you ask them. But they cannot review your source code and tell you <em>that you did that</em>. That is not their job or expertise.</p>
<p>So, you will need both, just like any other company: you need to educate yourself so you know to program in compliance with the law <em>and</em> you need a lawyer for that one page of paperwork.</p>
