What counts as personal data
Anything identifying a person: names, emails, phone numbers, addresses, and in many cases IP addresses. Most websites collect several of these through forms and analytics.
The practical obligations
In broad terms:
- Collect only what you need
- Say what you collect and why
- Keep it secure
- Delete it when it is no longer needed
- Be able to respond to a request about it
Where hosting comes in
Encryption in transit, access control, backups and a record of who can reach the data. These are hosting decisions as much as legal ones.
