Legal - GDPR FAQ

GDPR FAQ

Last Updated on October 12, 2021

What is the GDPR?

The General Data Protection Regulation (GDPR) is a European privacy law that went into effect on May 25, 2018. The GDPR replaces the EU Data Protection Directive, also known as Directive 95/46/EC, and will apply a single data protection law throughout the EU.

Data protection laws govern the way that businesses collect, use, and share personal data about individuals. Among other things, they require businesses to process an individual’s personal data fairly and lawfully, allow individuals to exercise legal rights in respect of their personal data (for example, to access, correct or delete their personal data), and ensure appropriate security protections are put in place to protect the personal data they process.

Who does the GDPR apply to?

The GDPR applies to all entities and individuals based in the EU and to entities and individuals, whether or not based in the EU, that process the personal data of EU individuals.

The GDPR defines personal data as any information relating to an identified or identifiable natural person. This is a broad definition, and includes data that is obviously personal (such as an individual’s name or contact details) as well as data that can be used to identify an individual indirectly (such as an individual’s IP address).

Does the GDPR apply to an individual developer?

Yes, if the individual developer is a customer of DigitalOcean and they are processing the personal data of EU individuals when using our products and services.

What is DigitalOcean’s role under GDPR?

We act as both a data processor and a data controller under the GDPR.

DigitalOcean as a data processor: When customers use our products and services to process EU personal data, we act as a data processor. For example, we will be a processor of EU personal data and information that gets uploaded into a Droplet. This means we will, in addition to complying with our customers’ instructions, need to comply with the new legal obligations that apply directly to processors under the GDPR.

DigitalOcean as a data controller: We act as a data controller for the EU customer information we collect to provide our products and services and to provide timely customer support. This customer information includes things such as customer name and contact information.

What have we done to comply with GDPR?

We conducted an extensive analysis of our operations to ensure compliance with the requirements of the GDPR before it went into effect. With the help of external advisors, we reviewed our products and services, customer terms, privacy notices and arrangements with third parties for compliance with the GDPR. Our focus on privacy and compliance efforts are ongoing.

What personal data do we collect and store from our customers?

We store data that customers have given us voluntarily. For example, in our role as data controller, we may collect and store contact information, such as name, email address, phone number, or physical address, when customers sign up for our products and services or seek support help. We also may collect other identifying information from our customers, such as IP address, Paypal ID, SSH public keys or Oauth tokens for external services.

We separately act as a data processor when customers use our products and services to process EU personal data, such as uploading personal data to a Droplet. Customers decide what personal data, if any, is uploaded to our products and services.