[spyder]

Even if he stores private data GDPR would not apply to him as an individual, but other laws may apply depending on the data and the country.