Should I worry about GDPR laws?
As an indie hacker building and publishing chrome extensions that can be used by anyone in the world.
Should I worry about GDPR laws etc?
As an indie hacker building and publishing chrome extensions that can be used by anyone in the world.
Should I worry about GDPR laws etc?
I think it is a sliding scale and how much you implement, is up to your risk appetite. On the easy side of things are things like implement a banner to accept/block cookies and making sure you don't store payment information. On the hard side is things like putting an automated process in place to ensure that users who have requested that their information is removed are also removed from your information if you ever restored a backup. When having no/low amount of customers I personally would implement the basics and implement more and more as your risk grows. Just make sure you are careful with your customers identifiable data.
That is exactly what I do. I do cookie banners and privacy info, don't store payment info, and delete user info upon request.
I totally aree with this.
I think it's important to be mindful of GDPR laws while building a service, not only because it's legally required, but also because it's the right thing to do.
At the same time, it's worth remembering that non-compliance is so widespread it makes enforcement incredibly hard. This is not an excuse not to implement the required procedures, but it's a reminder not to go overboard before having users.
TLDR: yes, worry, but build a business first.
For better or worse, GDPR is not yet strictly enforced and is currently targeting mostly big companies.
The best way to respect GDPR is to not share your user data with other companies and include few or no 3rd party resources on your website. This is the main reason GDPR was created, to avoid big scale user data harvesting and selling.
If you are handling sensitive user data you should have a dedicated data security person (GDPR enforces that each company actually has a designated data-protection officer). Consulting a professional or lawyer is the best way to respect GDPR.
No one can give you a definite answer. I'm not a lawyer and neither are most people commenting. I would say try your best to remain compliant... You have to figure out the answer yourself. I'd think your answer may vary depending on how many users your extension has/will have.
TBH, while a lot of the GDPR can be annoying it does foster a better relationship with user data. Don't think primarily about the fines, think about your users. In the long run your users will appreciate it. And you are setup for an international market.
Doesn't mean you have to start with perfect. Just approach it with the right mindset and you can adjust the details along the way. It might rule out some tools and marketing techniques. Just don't make them a core business dependency.
From my understanding, GDPR is related to processing of personal information and the users right to be forgotten. The easiest way to avoid this is:
Don't collect user info/ personal information (no user accounts that expose details, the user must remain completely anonymous, even an email address is too much)
If you use analytics, use a service that is privacy focused like plausible (no personal info is tracked at all)
If you cannot meet the above criteria, then you will need to make sure you are GDPR compliant. The fines are exorbitant (+- $20m)
Good luck ⚡️
Yes, you don't want to be in a bad situation.
Any useful resource you use for complying with the gdpr laws?
There's this website: https://gdpr.eu/
That makes for a lot of reading though :)
Really depends on what you're trying to do and the kind of info you're collecting. There are services (backed by lawyers) I believe that can help with this.
Yes, absolutely, unless you are profitable enough to pay the fines and still remain in the green.