united-kingdom gdpr european-union
How far up the chain of internet provision does my GDPR responsibility go?
<p>Say I host a web page on my computer, and you visit that site from somewhere in Europe.  The web server on my computer will know your IP address, and I can choose to &quot;forget&quot; it as soon as the request is completed (eg. pipe apache logging to /dev/null) or keep them and abide by the GDPR such as responding to SAR's.</p>
<p>However there are a number of entities involved in the process that may, and probably do, keep logs of the  transaction.  These entities will include my ISP, BT (who provide the to house infrastructure), some number of backbone companies, and your ISP.  I cannot access these logs, and given that I think it is a legal requirement to keep logs I think I cannot avoid such logging by choosing a different ISP.</p>
<p>How much of this logging am I responsible for under the GDPR?</p>

<p>You are only responsible for the data that you collect or process, or data that you direct others to collect or process on your behalf.</p>
<p>You are not responsible for the actions of third parties that may carry out incidental collection or processing that you have no control over - this includes such things as your ISP, backbone providers etc, but if you direct a service provider (eg Cloudflare, Amazon AWS etc) to cache your content and process it on your behalf then you need to include that fact in your data processing policy and link to the providers own data processing policy.</p>
