GDPR and privacy policy compliance for software used internally by customer company
<p>We are developing software that are sold to and used by other companies. In the software, certain types of personal data, like name, email and phone number, can be stored when a user registers. The data is stored on a server owned by our customer. Our customer owns all the data. Our software shows this data in certain places within our software itself, but does not share it with any other third parties, or store it on our own servers, or use it in any other way.</p>
<p>What are our requirements when it comes to providing a privacy policy for our software, to be compliant with GDPR? Will our software only be considered a tool used by our customer in which they collect personal data, and hence not require us to have our own privacy policy accepted by the users in addition, or will we have to have a privacy policy explaining what personal data which our customer is able to collect through our software?</p>
<p>All users of the software will be employees of our customer, if that makes a difference. They will therefore have their own privacy policy agreement with our customer (their employer) already.</p>

<p>Alice's business sells database management software.</p>
<p>Organisations buy or licence the software, deploy it on hardware they control and use the software to help store and, process and analyse 'personal data' within the meaning of GDPR.</p>
<p>Alice's business has no access whatsoever to the personal data being stored and processed by those organisations.</p>
<p>In respect of <em>that</em> personal data, GDPR is not engaged by Alice's business. The business is neither a 'controller' nor 'processor' of that personal data.</p>
<p><a href="https://commission.europa.eu/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/who-does-data-protection-law-apply_en" rel="noreferrer">Who does the data protection law apply to? - European Commission</a></p>
<p><a href="https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/who-does-the-uk-gdpr-apply-to/" rel="noreferrer">Who does the UK GDPR apply to? - Information Commissioner's Office</a></p>

gdpr privacy software