GDPR Compliance Report
Project: DigComp 3.0 Explorer Date: December 2025 Regulation: General Data Protection Regulation (EU) 2016/679
Executive Summary
The DigComp 3.0 Explorer is a fully GDPR-compliant, privacy-friendly application. The application does not collect personal data, does not require user registration, does not use cookies for tracking, and does not use any third-party analytics.
Current Status: Fully compliant
Data Processing Overview
Data Collected
| Data Type | Collected | Storage Location | Purpose |
|---|---|---|---|
| Personal data (name, email) | No | N/A | N/A |
| User accounts | No | N/A | N/A |
| IP addresses | No | N/A | N/A |
| Device information | No | N/A | N/A |
| Analytics/tracking | No | N/A | N/A |
| Language preference | Yes | localStorage (client) | UX improvement |
Data Storage Mechanisms
localStorage (Client-side only)
Key: digcomp-locale
Value: "en" or "de"
Purpose: Remember user's language preference
Retention: Until user clears browser data
Personal data: No
// lib/i18n-context.tsx
localStorage.setItem("digcomp-locale", newLocale)
GDPR Status: localStorage for functional preferences does not require consent under GDPR (strictly necessary for functionality as per Article 5(3) of the ePrivacy Directive).
GDPR Compliance Checklist
Article 6 - Lawful Basis for Processing
| Basis | Applicable | Notes |
|---|---|---|
| Consent | Not required | No personal data collected |
| Contract | No | No user contracts |
| Legal obligation | No | N/A |
| Vital interests | No | N/A |
| Public task | No | N/A |
| Legitimate interests | Yes | Language preference (strictly necessary) |
Article 7 - Conditions for Consent
Not applicable - No consent required as no personal data is collected.
Article 13 - Information to Data Subjects
Not applicable - No personal data is collected, so no information disclosure is required. However, transparency is maintained through the Privacy Policy page and this documentation.
Article 17 - Right to Erasure
| Data Type | Erasure Method | Status |
|---|---|---|
| localStorage | User clears browser data | Available via browser settings |
Privacy by Design (Article 25)
The application implements privacy by design principles:
| Principle | Implementation |
|---|---|
| Data minimization | Only language preference stored |
| Purpose limitation | Data used only for stated purpose |
| Storage limitation | Client-side only, user-controlled |
| No third-party sharing | No external services receive data |
| Transparency | Open source, documented behavior, Privacy Policy page |
What We Do Well
| Practice | GDPR Benefit |
|---|---|
| No user registration | No personal accounts to manage |
| No analytics or tracking | No consent banner required |
| No cookies | ePrivacy Directive compliant |
| localStorage only for preferences | Strictly necessary, exempt from consent |
| Static content | No server-side user data storage |
| No forms collecting personal data | No data subject requests to handle |
| No third-party services | No data processor agreements needed |
| Open source data | Full transparency |
| Privacy Policy page | User transparency |
Technical Implementation
No Third-Party Data Collection
The application does not include any:
- Analytics services (Google Analytics, Vercel Analytics, etc.)
- Tracking pixels or beacons
- Social media widgets
- Advertising networks
- Third-party fonts that track users (fonts are self-hosted via Next.js)
Client-Side Only Storage
// The only data stored - language preference
localStorage.setItem("digcomp-locale", "de") // or "en"
This is:
- Stored only in the user's browser
- Never transmitted to any server
- Fully controlled by the user
- Deletable via browser settings
Compliance Summary
| GDPR Requirement | Status |
|---|---|
| Lawful basis for processing | Compliant (legitimate interest for functionality) |
| Consent for tracking | Not required (no tracking) |
| Right to access | Not applicable (no personal data stored) |
| Right to erasure | Compliant (user can clear localStorage) |
| Data minimization | Compliant (only language preference) |
| Privacy by design | Compliant |
| Data protection impact assessment | Not required (no high-risk processing) |
| Cookie consent banner | Not required (no cookies, localStorage exempt) |
| Privacy policy | Implemented |
Conclusion
The DigComp 3.0 Explorer application is fully GDPR compliant by design. By choosing not to implement analytics, tracking, or user accounts, the application avoids the need for:
- Cookie consent banners
- Data processing agreements
- Data subject access request procedures
- Data protection impact assessments
The only data stored (language preference in localStorage) is strictly necessary for functionality and exempt from consent requirements under both GDPR and the ePrivacy Directive.
A Privacy Policy page is provided for transparency, accessible in both German and English.
Report generated as part of GDPR compliance review.