Even if you only use the website to present content and do not use any interactive elements where users enter personal data, there are a few things to bear in mind from a data protection perspective. 

When a website is accessed, data is transmitted from the website visitor's device to the server on which the website is stored. This includes general information about the type of access and the device, such as which browser is being used, whether the access is from a smartphone, tablet or PC and some other details. In addition, the current internet address of the website visitor is transmitted in the form of the so-called "IP address". 

The IP address is comparable to a postal address. With the help of the IP address, data can be sent from a server to the person accessing a website. It is therefore technically necessary for accessing a website. The IP address is unique at the time of use. The European Court of Justice therefore ruled in 2017 that a user's IP address is personal data and therefore falls under the provisions of the GDPR. 

Why? 

Theoretically, it is possible to identify the person using an Internet connection based on the IP address. Although this is only possible with a great deal of effort in the context of criminal investigations, it is still possible and it counts.

Since the IP address is a personal date, personal data is therefore already processed when the website is accessed. According to the GDPR, you must inform the data subjects about this. For this reason, every website in Europe requires data protection notices. 

Data protection notices on websites

In the data protection information, the website operator must provide information on what data is collected for what purpose, who has access to this data and how long it is stored. This information is sufficient for a normal website without additional functions. 

Data protection generators

There are several online tools for creating data protection notices. These can support you in the creation of data protection notices, but are no substitute for legal advice and are therefore without guarantee. 

If you also offer paid content on your website, you should urgently seek legal and data protection advice. 

Selection of some data protection generators: 

• For Germany: https://datenschutz-generator.de/
• https://dg-datenschutz.de/privacy-policy-generator/
• https://termly.io/products/privacy-policy-generator/ (nur mit Account)
• https://www.generateprivacypolicy.com/