# Providing data for GDPR

**URL:** https://meta.discourse.org/t/providing-data-for-gdpr/83595
**Category:** Community Building
**Tags:** gdpr, privacy
**Created:** [March 22, 2018, 6:36pm UTC](https://meta.discourse.org/t/providing-data-for-gdpr/83595 "2018-03-22T18:36:10Z")
**Posts on this page:** 1
**Showing post:** 23

<div class="post-metadata">

### Author: ![angus](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/angus/32/341715_2.png) [@angus](https://meta.discourse.org/u/angus)
#### Post date: [March 28, 2018, 2:23am UTC](https://meta.discourse.org/t/providing-data-for-gdpr/83595/23 "2018-03-28T02:23:21Z")

</div>

I don’t mean to offend, but this topic and its [companion](https://meta.discourse.org/t/gdpr-and-anonymizing-personal-data/72103) is a little misleading.

If you’re looking for reliable information on this subject you should restrict yourself to:

1. Official sources, e.g. the [European Commission’s Article 29 Working Party](http://ec.europa.eu/newsroom/article29/news.cfm?item_type=1360).

2. Formal legal advice.

Don’t rely on 3rd party summaries (or even what folks are saying here, including me).

Regarding the substantive points, I would point out a few things

1. Concerning the Article 29 Working Party’s [Guidelines on the Right to Data Portability](http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=611233) I note:

2. Concerning the Right to Erasure (aka “Right to be forgotten”), I would reiterate that the applicable timeline (like with the Right to Data Portability) is one month. There is no need to provide a one-click “Forget me” button for users. It is quite possible to comply with requests to be forgotten within the existing functionality of Discourse.

The bottom line here is that, as far as I can tell, Discourse does not contain any structural impediments to your compliance with the GDPR. Compliance with the GDPR is up to you, as it arises in specific cases and is largely a matter of organisational management, not one of technical functionality.

If you think the GDPR may apply to you, you should at a minimum review the help documents provided by the relevant [Data Protection Authority](http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm) in your jurisdiction (as they will be the ones actually enforcing the GDPR), and seek legal advice if you have specific concerns. If you’re not sure which DPA applies to you, you can review the European Commissions own documents I linked above, or just pick a DPA that uses a language you can understand.

None of the above constitutes legal advice, and I am not your lawyer.

---

_[View the full topic](https://meta.discourse.org/t/providing-data-for-gdpr/83595)._