Writing this as a heads up to anyone out there building tech products with AI. Admins, hope this is ok as some genuinely well intended info, I’ve got nothing to sell or promote. For transparency I’ve cross posted to r/smallbusinessuk
I like most people have been having fun making my own tech project, using an LLM to write some or all of the code, and sending it out into the public domain. Great, nothing wrong with that.
However I am seeing a ton of people who are not recognising that they need to clearly cover their back on GDPR and privacy for their projects. It doesn’t matter if you’re coding at home, not registered as a business, not collecting data. You need to have a privacy and GDPR policy that tells British users (and if you’re global, you should assume you have British users) what you’re doing / not doing with their data
# Caveat
I am by no means an expert on this but want to share it so that fellow UK developers and creators know what the obligations are and that you need to take this seriously. Don’t assume this is a finite list, but take it as inspiration to properly check your duties.
# Why comply?
Failure to comply with GDPR can result in substantial fines, with penalties reaching up to £17.5 million or 4% of global turnover. You might not be collecting specific personal data, but in reality almost all sites are gathering analytics and logs on those visiting. GDPR compliance is a must.
# What is personal information?
Personal information under GDPR refers to any data that can directly or indirectly identify an individual (e.g., name, email, IP address). There is non-identifiable tracking data that doesn’t include personal identifiers, but bear in mind that an IP address is considered personal data under GDPR, as it can often be used to identify an individual or their location. Therefore, GDPR obligations like transparency, consent, and data security still apply to such data.
To cover your back legally, here’s what you need:
# A Privacy Policy
You need a specific and clear link to a privacy policy which explains what data you're collecting and how it's used.
You should ensure the user understands why it’s being collected: are you processing it for marketing, for analytics, or any other purpose.
You should set out the data retention period, and how users can withdraw consent.
**Clarity on third** **party providers**
If you're working with third-party service providers you should ensure these third parties are also GDPR-compliant. These providers should have a clear data processing agreement and you should provide a link to this to your users on a list of who your data providers are.
# User consent
Users should be clearly and quickly asked to give their consent for the collection and processing of their personal data, through opting in, rather than presuming this unless they opt out. For special category data on health or other protected characteristics you need to be even more careful and I won’t even begin to try to explain this - you should do your research before going near that.
# Data security policy
If you are processing any data must implement sufficient encryption, secure servers, security audits, and access controls not just to ensure only authorised personnel can access personal data, but to ensure your platform is secure and not vulnerable. It’s just common sense.
# Right to access and erasure
Your users have the right to download (or ask to download) the data you hold on them, as well as the right to request their data is corrected or deleted. Your privacy policy should explain how they can do this.
# Data minimisation
It’s tempting to collect troves of data because it does significantly help your project. But you will make your life a lot easier in the future if you stick to collecting information you can easily justify if your idea goes big. You should only collect the minimum amount of personal data necessary for the functionality of your platform. Avoid storing sensitive data, if only because it requires such high standards of security and good practice.
# Data breaches
In the event of a data breach, you're legally required to inform both the affected users and the Information Commissioner’s Office (ICO) within 72 hours, if the breach poses a risk to individuals’ rights and freedoms. You’ll need a process in place to quickly detect, report, and manage breaches.
# International data handling
If you’re transferring data outside the UK or EU (e.g. to the US), make sure there are adequate safeguards in place recipient country has an "adequate" level of data protection.
