The General Data Protection Regulation that is about to come into effect in the EU appears to impose requirements to (among others) anyone who runs a website of public interest. As some of these requirements are difficult to fulfil for projects developed during people's spare time without any revenue (e.g. getting legal counsel for a legally watertight privacy policy text, getting webspace and an e-mail inbox whose providers agree to sign processing agreements1, etc.), this might prevent EU-based FOSS projects from having a website aside from the default project profile pages on Github and the like2.

Have there been any statements by the people or institutions behind the GDPR on what the expected effect on open source software projects will be (e.g. the described issues are an intended/unintended side effect, the issues won't occur because ..., they consider the issues irrelevant, ...)?

1: Also see: Contract necessary for the most basic processing under GPDR? on Law SE

2: Note that I'm not referring to the few high-profile projects out there that are backed by foundations and such.


The GDPR applies when processing personal data. The solution for open source projects: Don't process personal data. A static website without any analytics does not perform meaningful processing of personal data.

If you as a project maintainer are still concerned about this, write a short privacy policy that personal data such as IP addresses are processed for the sole purpose of displaying the site, and sign a data processing agreement with your hoster. Currently, I can't find any indication that GitHub or GitLab offer a DPA, but many EU-based hosters do.

If you do process any data, then of course the GDPR applies even for hobby projects. The point of the law is to protect personal data, not to punish businesses. And aside from this initial panic, compliance does not take much effort when not processing personal data.

From the GDPR perspective, accepting pull requests into a git repo is much more problematic, since the blockchain-nature of git makes it impossible to delete or correct personal information (such as author name and email addresses) afterwards. However, this is not necessarily in violation if you obtain prior informed consent from contributors.

| improve this answer | |
  • Very insightful, thank you. Interestingly, the first paragraph of the answers appears to contradict everything I have read about GDPR in German. The consensus among German articles on the topic seems to be that the requirement to provide a GDPR-conformant privacy policy applies to virtually all websites, and as virtually all web hosters do at least temporarily log IP addresses, there is invariably some relevant processing of personal data. Furthermore, as soon as someone sends an e-mail related to your website to the address stated there, that's more personal data whose GDPR-conformant ... – O. R. Mapper May 5 '18 at 11:45
  • ... handling you have to ensure and declare in the privacy policy. Do you have any references or analyses that back up this opposing view your answer presents (in particular by the parties involved in defining GDPR, to also match with my original question)? In any case, the takeaway from your second paragraph seems to be that EU-based open source project maintainers should use the U.S.-based open source sites only for the integrated tools such as VCS and bug trackers, and move their self-designed websites to an EU-based hoster that provides a DPA. – O. R. Mapper May 5 '18 at 11:49
  • 1
    You just wrote "GDPR does not apply to static websites without analytics" , what about IP logs of the website? – compenthusiast Nov 11 at 8:38
  • 2
    @compenthusiast This answer was written 2.5 years ago and my understanding of GDPR has since deepened. I am now of the opinion that any website performs processing of personal data precisely because IP addresses and other traffic data (as defined by ePrivacy) are likely to be personal data (as defined by GDPR). – amon Nov 11 at 8:43
  • 1
    Did you feel I was blaming you or something.Not at all Actually I am searching GDPr and CCPA every where because it seems impossible to understand how small developers will comply with GDPR. I cannot even host a GitHub Pages site .What is this! – compenthusiast Nov 11 at 9:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.