Which, if any, data protection laws apply?
<p>I am the DBA (Database Administrator) of an online group. We store a few bits of personal data for our members. Name, Age, Email. Nothing huge. The rest of the data is specific to our group.</p>

<p>I don't believe we need to do anything specific but I wanted to check.</p>

<p>The thing that I believe makes this complex is that I think there are possibly different countries laws that apply:
I (the DBA) live in the UK.
About 4/5 of our members are US based.
A spattering of members from EU countries.
The data is stored on a server in Canada.</p>

<p>Based on <a href="https://www.gov.uk/data-protection/the-data-protection-act" rel="nofollow noreferrer">this</a> website, in the UK we are based as a hobby group and thus I do not need to do anything. What I don't know is if any other countries law would apply?</p>

<p>Thanks for any help!</p>

<p>Since you're interacting with people in the US and know the age of your users, <a href="https://www.ftc.gov/tips-advice/business-center/guidance/complying-coppa-frequently-asked-questions" rel="nofollow noreferrer">COPPA</a> applies if any of them are under 13 years old: </p>

<blockquote>
  <p>Foreign-based websites and online services must comply with COPPA if they are directed to children in the United States, or if they knowingly collect personal information from children in the U.S.  The law’s definition of “operator” includes foreign-based websites and online services that are involved in commerce in the United States or its territories.  As a related matter, U.S.-based sites and services that collect information from foreign children also are subject to COPPA.</p>
</blockquote>

data-storage