If you mean complying with requests for deletion, exports of personal data or name updates I suppose that can be handled via email as well. Since it's all manual I would assume you can just update the files and re-generate the site.

The only real problem is verifying the legitimacy of requests. How do you know for sure that an email containing a GDPR request came from the same person that also sent the comments? I guess you could come up with some rules. For example, if the request was signed with the same GPG key as the original comments or if a request passes DMARC...

I'm curious to hear what the author thinks of that!

Addendum: If you track your website's sources in a public VCS and include comments in there you probably have to run a "filter-branch" (or whatever your VCS has for that) over it to purge PII from the version history.

> Art. 2 GDPR: This Regulation does not apply to the processing of personal data: [...] (c) by a natural person in the course of a purely personal or household activity

That is a valid concern. I had someone send a GDPR request to have their data removed, on my small website / newsletter.

It does and can happen. Albeit, not often.

why?