GDPR - A mobile App that allows user to store media do we have to option user consent?
<p>I have a few doubts about GDPR law. If we are a mobile app, that allows user to store data inside our application like photos, videos, notes. etc., then do we have to get user consent or anything related to GDPR?</p>
<p>Example: a vault app.</p>
<p>Also, if the user is storing the data in our app, but the data is not encrypted, then do I need to encrypt data even if are aren't subject to GDPR?</p>
<p>The data is stored locally on the user's phone and it's not uploaded to server.
It's like a private gallery application which is password-protected. The user can move photos.</p>

<p><strong>Assuming the data is only stored on the users's device</strong>, (as mentioned in a comment), the GDPR does not apply to the developer of an application. </p>

<p>It could however apply to the user who uses the application. But the question seems to indicate it will be for private use only, the exception in <a href="https://gdpr-info.eu/art-2-gdpr/" rel="nofollow noreferrer">Art. 2 (2)(c) GDPR</a> would apply.</p>

<blockquote>
  <ol start="2">
  <li><p>This Regulation does not apply to the processing of personal data:</p>
  
  <p>(c)   by a natural person in the course of a purely personal or household activity;</p></li>
  </ol>
</blockquote>

<p>If the GDPR would apply, for example because it is used by a company storing photos of customers, it would be the responsibility of the user to comply with the GDPR. If the application is not GDPR-compliant, the user would have to stop using the application.</p>

<blockquote>
  <p>if the user is storing the data in our app but the data is not encrypted then do I need to encrypt data even if we do not fall in GDPR?</p>
</blockquote>

<p>This reply assumes that you are doing some of the processing and/or storage, as opposed to leaving it all on the user's device.</p>

<p>The GDPR does not directly mandate encryption. Article 32(2) says:</p>

<blockquote>
  <p>In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.</p>
</blockquote>

<p>So you need to think about how sensitive the data is likely to be. Then design your data processing and management practices (e.g. which employees have access, what procedures must they follow) accordingly.</p>

<p>So the upshot of all this is, no you don't <em>have</em> to encrypt the user's files, but doing so might well be a good idea.</p>

gdpr