united-kingdom privacy england-and-wales gdpr
GDPR liability for Web Designer
<p>I am a web designer that works with a range of clients on a project basis. I complete a project and then offer my services at any hourly rate for any other work required in the future.</p>

<p>Do I have a legal responsibility to ensure any projects are GDPR compliant which are:</p>

<ol>
<li><p>finished before 25th May 2018?</p></li>
<li><p>finished after the 25th May 2018? </p></li>
</ol>

<p>If you are purely a designer (and not contracted for the daily operation of the site), the answer is "no".</p>

<p>GDPR Article 4 defines the "roles" responsible for complying with GDPR, and there are two: <em>Controller</em> and <em>Processor</em>.  The <em>Controller</em> is the one who calls the shots. In particular: Decides what personal data to process. This is usually the <em>owner</em> of the web site.  The <em>Processor</em> is the one that actually does the processing. This is usually some company providing some sort of data processing service (e.g. SaaS, PaaS, etc.).  The relationship between the Processor and the Controller must be contractual. The contract is called a DPA (Data Protection Agreement or Data Processing Addendum).</p>

<p>As a designer, you don't fit into any of these roles. If your contract with the client is silent on liability for GDPR compliance, then you have no liability.</p>

<p>This goes for projects completed both before and after the May 25 deadline.</p>

<p>Of course, if there are GDPR clauses in your contract, then you must fulfil them just as have to fulfil any other contractual obligation.  But unlike the controller and the processor, there are no automatic legal liability for a designer or programmer.</p>
