gdpr
Replication of user data a violation of GDPR
<p>I'm in the planing staging of building game service provider, kind of like Xbox Live, PSN, Steam, etc.</p>

<p>As far as I understand in the terms of the GDPR, information that can directly identify users should remain only in the region where it was created (such as their e-mail address, real name and surname, etc).</p>

<p>The question I want to ask, is it possible for me to replicate the user player profile, meaning the gamer profile that contains the "gamer score", avatar, etc to different regions without violating the GDPR requirements, and only linking this with an ID that is shared between the real-user profile and the gamer profile?</p>

<p>The profile almost certainly contains an online 'handle' and this is <a href="https://www.itgovernance.eu/blog/en/the-gdpr-what-exactly-is-personal-data" rel="nofollow noreferrer">personal data</a>. Even without this, a combination of other factors (e.g. if the person had the highest ever high score) could allow identification of 'that guy'. </p>

<p>Personal data kicks in where it is possible to use the data to work out the individual to whom it belongs - you don't have to know the person's name to do that. For example, you probably don't know the name of the person you sit near everyday on the bus but a photo of that person, or even the knowledge that they catch that bus from A to B every day, is enough to identify them.</p>

<p>You can only transfer the data out of the EU subject to the GDPR rules.</p>
