GDPR compliance for software that lets users store PII of other people
<p>Most times you see GDPR it relates to the first party storing data about their users, customers, whatever. I'm a developer for some hosted software (SaaS if you will) that allows —as a very tangential feature— users to store a personal address book of their contacts.</p>

<ul>
<li>Is that legal now?  </li>
<li>Do we have to consent every third party contact before they're added into the address book of one of our users?</li>
<li>More worryingly, do we have to respond to personal data requests from contacts? For example, would we have to reveal <em>who</em> had added them to their address book?</li>
</ul>

<p>We are within the EU, operating solely within the EU for now.</p>

<p>In this scenario, you are a <em>processor</em>, not a <em>controller</em>. (see <a href="http://www.privacy-regulation.eu/en/article-4-definitions-GDPR.htm#a4_nr8" rel="nofollow noreferrer">Art. 4 (8) GDPR</a>) (obviously you may well be a controller too)</p>

<blockquote>
  <p>Is that legal now?</p>
</blockquote>

<p>Yeah, if you comply with all the obligations, especially <a href="http://www.privacy-regulation.eu/en/article-28-processor-GDPR.htm" rel="nofollow noreferrer">Art. 28 GDPR</a>. Note that your processor relationship needs to be defined in a contract (like a <em>Data Processing Agreement</em>, which is referenced in the controller's privacy policy) </p>

<blockquote>
  <p>Do we have to consent every third party contact before they're added into the address book of one of our users?</p>
</blockquote>

<p>If a user (a company or even a natural person) uses your product's address book feature to keep track of contacts, they are the controller, and this would be covered under the DPA. (<a href="https://www.agilecrm.com/legalese/data-privacy/dpa" rel="nofollow noreferrer">here's an example</a> of one of those). Also, consent is only one of the possible ways to lawfully process data (see <a href="http://www.privacy-regulation.eu/en/article-6-lawfulness-of-processing-GDPR.htm" rel="nofollow noreferrer">Art. 6 GDPR</a>)</p>

<blockquote>
  <p>More worryingly, do we have to respond to personal data requests from contacts? For example, would we have to reveal who had added them to their address book?</p>
</blockquote>

<p>If you want to be helpful, you can refer the subject to the actual controller. You only need to respond to subject access requests if you are actually processing personal data, and it sounds like you're not doing that here.</p>

european-union gdpr