Does GDPR restrict handling data that the user has certified is not personal information
<p>If my site ToS has this:</p>
<blockquote>
<p>By submitting data to the this site, you certify that the data is not of a nature that would cause me to have any special obligations under applicable law.</p>
</blockquote>
<p>And someone from Europe submits personal information, am I obligated to remove it?</p>

<p>This question shows a misconception of GDPR.</p>
<ul>
<li>GDPR creates an obligation not just towards the <em>data subject</em> but also towards the authorities of the relevant state(s). The data subject cannot waive your responsibility to safeguard data, document internal processes, etc.</li>
<li>GDPR is not a blanket ban on the handling of personally identifying information (PII). Informed consent is one of the ways to get permission to process and store this data. If your <em>data subjects</em> are prepared to give your sweeping permissions, ask for consent (informed, revocable, etc.), document the consent, and go from there.</li>
<li>The <em>data subject</em> does not get to decide what classification data falls under. If you collect, say, medical data, then you <em>are</em> subject to increased restrictions and safeguards.</li>
</ul>

<p>Yes. Assuming you fall under the GDPR.</p>
<p>You are by law required to remove it if requested (and no other law overrides this, for example if you need it for billing or taxes or other legal obligations).</p>
<p>The fact that your user broke your terms of service is between you and your user and cannot undo existing laws. You can do whatever you do when users break your terms of service, but you do not get to break the law by keeping the information.</p>
<p>Compare for example if someone sells you stolen goods. The fact that they lied and told you the goods were legit does in no way mean you get to keep them. Someone making false claims does not mean the laws around it are null and void. They still exist and they still take precedence over &quot;but they said so!&quot;.</p>

<p>You cannot make your users waive their legal rights for no good reason.</p>
<p>It's still a good idea to state in the ToS that users are not allowed to submit PII in certain forms. Such submissions can still happen of course, but having a &quot;no private data allowed&quot; rule gives you a good reason to remove the problematic content without upsetting your users.</p>
<p>&quot;Letting anyone delete their own content&quot; doesn't solve the problem, user A could use your service to post B's personal data, and you'll still have to deal with B's complaint.</p>
<p>&quot;Letting anyone delete any content&quot; is so prone to abuse that it'll be probably easier to deal with a GDPR complaint once in a while, than to explain to users why their data is gone.</p>
<p>Auto-deleting the content after a few days will be a much cleaner strategy with the same effect of practically avoiding GDPR complaints.</p>
<p>And BTW, you actually <strong>want</strong> to collect some private data about your users if you host their data, even for a few days. If user A posts B's credit card info, it will not be sufficient for B to have it removed. If B's information was used to steal their money, and B finds this information on your site, you'd better have A's PII when the police shows up.</p>

gdpr