GDPR
Definition
The GDPR sets out what an organisation may do with personal data — information relating to identifiable people — and what those people can require in return. It reaches beyond Europe: if you offer goods or services to people in the EU, or monitor their behaviour, it applies wherever your servers and your company happen to be. Two roles run through the text — the controller, who decides why and how data is processed, and the processor, who acts on the controller's instructions, which is usually where a hosting provider sits. Every processing activity needs one of six lawful bases, most often consent, contract or legitimate interests, and a handful of principles apply throughout: collect only what you need, keep it only as long as you need it, be clear about what you are doing. People can ask what you hold, ask for it to be corrected or deleted, and complain to a regulator; fines reach 20 million euros or 4 per cent of worldwide annual turnover, whichever is higher.
Why It Matters
For a small publisher the burden is lighter than the headlines suggest, but the traps are real. The commonest failure is collecting data with no thought about the basis for it — an email list built from a download form with no explanation, kept indefinitely, used later for something else entirely. The second is analytics, where a tool that plants identifiers on visitors changes what you must disclose and often what you must ask permission for. The third is silence: no privacy notice, so nobody can tell what happens to their address after they type it. None of this requires a legal department, and what follows is general information rather than legal advice, but a site that collects anything at all should be able to answer three questions: what do we hold, why, and for how long.
How It Works
In practice compliance is a short set of documents and decisions rather than a piece of software. You write down what you collect and why, choose a lawful basis for each purpose, and publish a privacy notice that names the categories of data, the retention periods and the recipients. You agree terms with the companies that process data for you, and check where they keep it, since transfers out of the EU need their own footing — an adequacy decision for the destination country, or standard contractual clauses, which is where data residency becomes a practical question rather than a theoretical one. You set a deletion schedule and actually run it. And you keep the collection small, because the cheapest way to satisfy a request for erasure is never to have held the thing in the first place.
Real-World Example
A studio gates a case study behind a lead capture form at design-casestudy.99helpers.site, asking for name, email and company. The lawful basis is consent for the newsletter and legitimate interests for sending the document itself, the notice under the form says both in two sentences, and the tick box for marketing starts empty. Addresses collected through 99helpers are exported to the mailing tool weekly and cleared from the form store afterwards, so there is one copy rather than two. When someone asks to be removed eight months later it takes a minute, because everyone knows where the list lives.
Common Mistakes
- ✕Assuming it does not apply because the company is outside the EU — the test is who the data is about, not where the server is
- ✕Treating consent as the answer to everything — a pre-ticked box or a bundled agreement is not consent, and other bases often fit better
- ✕Collecting a phone number and a job title because the form template had fields for them — every extra field is data you must justify, protect and eventually delete
Related Terms
Personal Data
Any information relating to a person who can be identified, directly or indirectly. The definition is broader than most people expect — an IP address counts, and so does an identifier that only becomes a name when combined with something else.
Cookie Consent
Permission a visitor gives before a site stores or reads non-essential information on their device. A site that sets nothing beyond what it strictly needs does not require a banner at all.
Data Retention
How long data is kept before it is deleted, and the rules that decide that. Keeping everything forever is a decision too, and usually the wrong one.
Data Residency
Where data physically sits — which country's disks hold it, and therefore whose laws reach it. Buyers ask about it because a storage location carries a jurisdiction with it.
Lead Capture Form
A short form shown in front of a hosted file or site: the visitor gives a name and an email, the content opens, and the answer lands in the owner's dashboard.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →