[LoSboccacc]

There’s more to that. Startups now exists as a constellation of services and it’s quite hard to tell what goes into a PIA document and whar not.

Say our landing web page contains an intercom chat widget and google analytics tracking.

At that point we have collected the user ip at most, which would become sensitive only if connected with data from two other businness entities.

What the heck am I supposed to write into the damn thing now?

[_o_]

Ask your chat provider if he is GDPR compliant, he will provide you the confirmations that you need to add to your page. Regarding google analytics, you are risking getting banned if you feed it with personal data (including ip).

https://gdpr.report/news/2018/02/01/gdpr-google-analytics-2/

If I were you, I would add my own chat (there is bunch of them on github) and use piwik instead of google analytics.

(By the rule of the thumb, for each 3rd party provider, ask them about gdpr compliancy and purge all the data you are not getting user consent - GDPR is retroactive)

[grabeh]

There are several grounds on which you can legally process data in addition to consent, so it is unhelpful to talk in general terms about purging data where you are not getting user consent. If you are using data to provide a service, then generally it will not a consent-based processing for example.

You have to assess each use to which you put any personal data and determine the correct processing basis for that usage. Often there are more relevant bases than consent.

I do appreciate that the definition of 'consent' in this regard is often thought of in different terms though. When I think of consent I think of the narrow data protection consent, whereas I think often in layman's terms it has a broader definition which is often linked to disclosure requirements in relation to privacy policies etc.