> You know the best way of not having to care about GDPR? Don't store PII.
I hear this a lot. As an American that hosts casual personal websites, I can't help but worry that I'm in violation of the GDPR.
For example, my router logs connections for debugging. And my NGinx server maintains server logs for debugging.
These contain IP addresses. I'm pretty sure those are considered PII under GDPR. And there are a lot of things I think that follow from that, things I haven't bothered to look into or implement. Like whatever policies, disclaimers, notifications, request handling processes, etc. that need to be in place to gather those logs.
Whether or not I need a registered agent in the EU to host my website seems to be rather fuzzy too. It seems to come down to how "sensitive" the data I store in my logs are?
Its also not clear to me whether my home router is subject to GDPR if it receives and logs a packet that was sent to it by an EU citizen, regardless of whether there was a public internet service hosted on that router or not.
I mostly choose to not think about these things - but that nagging concern that my entire self-hosted digital presence violates European law does linger.