Do I have to include a GDPR in my app even tho I don&#39;t collect data from users?
<p>I have written an <code>android app</code> The user does some HTTP requests do an endpoint and gets data, also the user can download images to his own storage. But I don't collect any data from the user?  </p>

<p><strong>Is is mandatory for the dev to include the GDPR although he doesn't collect data?</strong>  </p>

<p>If so, what?</p>

<p>Any website or app potentially has access to personal data. You decide how this data will be processed, so you are a Data Controller and must comply with the GDPR This includes obligations such as providing privacy policy style information and assessing potential risks for your users.</p>

<p>If you are not using any of the data you have access to, that makes compliance very easy. Where you share data with third parties (<em>such as by making HTTP requests</em>) that is already a bit more complicated. Who runs that endpoint? Under what legal basis can you send them data? Does this count as an international transfer? What will they do with personal data? How do you protect the connection, e.g. by using HTTPS?</p>

<p>In practice this is still fairly simple, but compliance is not zero effort.</p>

gdpr data-protection