Hacker News Reader

Comment by cyberferret | Hacker News Reader

Does that still apply if we are a 'data processor' according to their definition? We are an Australian company, with servers based in the US, and we have EU companies actually using our SaaS to manage their employee's information (also based in the EU). We haven't had formal legal advise on this, but upon discussions with other service providers, it seems we still have to be compliant because our paying customers who actually own the data are based in the EU.

View on HN

If you're doing business with the EU, my opinion is that you should comply to GDPR. Your EU business customers will very likely demand / require it, if not today then sooner than later. Those EU businesses will be assessing the services they utilize and trying to make sure there are no holes in their own GDPR compliance as a consequence.

As a counter example. A US-based service I'm building now, will have zero business dealings with the EU, although it may store EU resident data (people that sign up that are from the EU). I have no concern about complying any time soon. I may choose to never comply, as I doubt I'll be drawing revenue from the EU. It's about the last thing on my list of things to worry about (GDPR, not user privacy in general).

If you're doing business with companies doing business with the EU, you should probably comply. GDPR compliance requires certain affiliated businesses that are involved with the data you collect to also be compliant. The US-based company I work for is in the process of switching to Stripe for ACH invoicing because bill.com isn't going to be GDPR compliant.

EU law says that it's only legal to transfer personal data to companies that have adequate level of protection for personal data. Certain countries are considered to meet the adequacy requirement, but Australia is not one of them[1], so you probably need to meet the requirement using a contract[2]. You should probably consult a lawyer.

[1]: https://ec.europa.eu/info/law/law-topic/data-protection/data...

> The European Commission has so far recognised Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and the US (limited to the Privacy Shield framework) as providing adequate protection.

[2]: https://ec.europa.eu/info/law/law-topic/data-protection/data...

Yes, EU companies are going to want legal guarantees that you'll fulfill your duties as a data processor under EU law. Common term for such a thing is "data processing agreement", quite a few services offer them in a more-or-less self-service fashion.

Reply on news.ycombinator.com