gitprivacystatic-pagesjamstack

How to build a GDPR compliant git-based static page?


When processing personal data, the European GDPR requires the deletion of specific personal data under certain circumstances "right to be forgotten".

If there is personal data in the content of a git-based static page, it will be part of the git commit history in my understanding.

If you are now asked to delete the personal data found in the content, the personal data will still remain in the commit history and are therefore not completely deleted.

Is it possible to replace personal data in old commits (content versions) with a generic placeholder in the git commit history? This way, one could delete the personal data without having to delete the entire commit history.


Solution

  • It looks like there are 2 separate aspects at play. Firstly, in terms of serving your git-based static page: you shouldn't have anything to worry about from the git side. Without performing git operations (add, commit, etc.) you won't be storing any user/customer information in git. Whatever service is hosting the content (hosting provider, CDN, etc.) might have some logging or other user-tracking behavior you'll need to evaluate but that's separate to git and would be the case if you just uploaded some static content via FTP, SCP, or a web portal, or any other way to serve up static content.

    If others are contributing to your git repository or your making commits that include customer information then it's actually going to be difficult to remove that information git commits are based on the parent commits so if you change a past commit "P" then all commits that have the ancestor "P" will be updated if "P" were to be altered. In that regard git is not a good system to store information you might want to remove (it's actually designed to be resilient to having information removed).