Under the GDPR in Germany, is a privacy-policy required when not tracking any personal data whatsoever
<p>I have a small static personal website, where I publish some technical articles and my personal CV.
Do I need to include a privacy-policy if:</p>
<ul>
<li>There are no (third- or first party) tracking services used</li>
<li>There are no IP logs kept</li>
<li>There are no comment fields or other features where users can enter information to be saved</li>
<li>I do not publish information about specific persons in the articles</li>
</ul>
<p><strong>To provide an idealized model, assume that the server is configured to forget ALL state after serving a HTTP request for the website. Nothing about the request is saved. Not even information like traffic statistics that would confirm a request happened at all.</strong></p>
<p>An additional concern would be that website is hosted on a root-server with a German provider (Netcup). Do I need to inform people that this provider could theoretically collect data (still nothing more than IP addresses with timestamps and encrypted TLS traffic)?</p>

<p>Congrats, you've done well to minimize your processing of personal data. But I think you're still processing personal data, and are subject to the GDPR.</p>
<p>Serving a website necessarily involves processing an IP address. This IP address will typically be personal data. While you are not storing the IP address, the GDPR's definition of “processing” extends beyond storage and pretty much covers doing anything with that IP address. As far as I know this is not an entirely settled matter, but it's better to err on the side of caution and to assume that you are in fact performing a processing activity. Even a static web page can easily lead to additional relevant processing of personal data, for example if the HTML embeds resources from third party domains.</p>
<p>Since your website is clearly targeted at the public, it does not fall under the GDPR's exception for “purely personal or household” purposes.</p>
<p>So I think you do need a (minimal) privacy notice that contains at least the items mentioned in Art 13 GDPR. The main reason why some people try to avoid posting a privacy notice is because it must disclose your identity and contact details. But in Germany, that information has to be provided anyway due to the <em>Impressumspflicht</em>.</p>
<p>As part of your GDPR compliance obligations, you must protect how data is processed by others on your behalf. A hosting provider will typically act as your <em>data processor</em>. For this to be legal, you need a contract / data processing agreement that fulfills the conditions in Art 28 GDPR. This contract binds the data processor to only use the data as instructed by you, and not for their own purposes. European hosting providers sometimes include the necessary terms in their terms of service / AGB, but you should check to make sure. Netcup expects you to accept their data processing amendment in your account settings.</p>
<p>In the hypothetical case that you were not processing any personal data at all, the GDPR would not apply and it wouldn't require you to post a privacy notice. Other laws might still have information obligations, notably the German TMG and TTDSG.</p>

gdpr personal-information