GDPR - does a unique device identifier count as personal data?
<p>I'm planning to sell my software online. The payment process is handled by a reseller (FastSpring), so the personal data collected (like the buyer's name and e-Mail address) is never stored on my servers.</p>

<p>I supply a license that allows the user to use the software on up to three devices. To enforce this, I store a unique device identifier in my database whenever a license is used to activate the product.</p>

<p>Does this unique device identifier count as personal data under the GDPR, i.e. do I need to add GDPR disclaimers to my privacy policy and take the required steps, such as appointing a "Data Protection Officer" in my company, or can I safely go without it?</p>

<p>I'd argue that the unique device identifier does not allow me to trace the license to any specific individual, only to a device.</p>

<p>Would it help if I encrypted the device identifier in my database?</p>

<p>It depends on the device identifier. </p>

<p>For example, if you distribute your application through Apple's App Store, there is no way for you to get any identifier for the device. You can get an identifier that is unique for the combination of the device + your application, so you can verify that the same user doesn't use the application on four devices. But if I have another application, we can't combine our data to see who has purchased both applications, because we get <em>different</em> device identifiers for the same device. So that device identifier is totally meaningless to anyone other than you.</p>

<p>(Years ago Apple supplied real device identifiers. They stopped for privacy reasons, and because some developers were just stupid - they didn't consider that I could sell my phone to you and buy a new one. So if I sold you my phone, you reset it completely and purchased a certain game, you would get my high scores because your phone has same device identifier that I used for ages).</p>

gdpr identification