GDPR Compliant Community Platform: What You Control

No software makes a community GDPR compliant on its own. Compliance is the job of the site owner: you need a lawful basis for the data you hold, a privacy notice, agreements with every company that handles member data for you, and a clear answer on where that data is stored. A platform can help with the tools. It can’t do the legal work for you.

What a self-hosted platform changes is control. You pick the host and the country, and no software vendor’s cloud sits between you and your members’ data. This guide covers what that means, what BuddyNext gives you, and what stays on your list.

This is general information, not legal advice. For your own situation, ask a lawyer or your data protection officer.

Is there such a thing as a GDPR compliant community platform?

Not in the way the phrase suggests. The GDPR doesn’t certify software. It puts duties on the organizations that decide why and how personal data is used (called controllers) and on the companies that handle data for them (called processors).

If you run a community, you are the controller. Your members’ names, emails, posts, messages and profile details are personal data. So are IP addresses and the cookies your site sets.

So when a vendor says “GDPR compliant,” read it as one of two things:

• The software offers features that help you meet your duties, such as data export and erasure.
• The vendor promises, in a data processing agreement, to handle your data in line with the rules.

Both are useful. Neither makes your community compliant. You still have to decide your lawful basis, write your privacy notice, handle member requests and keep records.

We’d rather say that plainly than sell you a badge. BuddyNext is a set of tools you can use to run a community responsibly. We don’t say it makes you compliant, and you should be wary of any product that does.

What does the site owner have to do?

Here is the short list that applies to almost any community site. The details depend on your country, your members and your use of their data.

• Pick a lawful basis. For example, consent, a contract with a paying member, or a legitimate interest. Different data can have different bases.
• Publish a privacy notice. Say what you collect, why, who you share it with, how long you keep it and how members can exercise their rights.
• Sign agreements with processors. Your host, your email service and any other service that touches member data should have a data processing agreement with you.
• Know where data is stored. If personal data leaves the EU or UK, there are extra rules for the transfer. Choosing your host’s region is the simplest way to stay in control.
• Handle member requests. People can ask for a copy of their data or ask you to erase it. You need a way to answer, and a deadline you can meet.
• Keep only what you need. Set retention periods and delete old data on a schedule.
• Handle cookies properly. Where the law asks for consent, ask before setting non-essential cookies.
• Secure the site. Keep WordPress, plugins and PHP updated, use strong logins and keep backups.

Some of this is paperwork. Some of it can be done with settings in the software. The next sections show which parts BuddyNext covers.

What does self-hosting change?

When you run community software on your own server, three things shift in your favor.

You choose the host and the country. The community lives in your WordPress database, on the server you picked. If your members are in the EU and you want the data to stay there, you can choose an EU data center. You decide, and you can change your mind later by moving the site.

There is no vendor cloud in the middle. With a hosted community platform, the vendor stores your members’ data on its own infrastructure and acts as your processor. With BuddyNext, the community runs inside your own WordPress site, and its data sits in your database. No hosted community service is needed to run it.

You can see and export everything. It’s your database. You can back it up, query it, move it or delete it without asking anyone.

Self-hosting doesn’t remove duties. You still need a lawful basis, a privacy notice and a good host. And you now run the server, or pay someone who does. If you don’t keep WordPress updated and backed up, you have a security problem, and a security problem is a data protection problem too.

For a wider look at the trade-offs, see our guide to self-hosted community platforms.

What member data tools does BuddyNext give you?

These are in the free core, based on the Privacy and Data docs. Owners find them under BuddyNext, then Members, then Privacy and Data.

Three notes on the table. Retention is narrower than it might sound: it covers closed moderation reports and, with Pro, analytics events. It does not delete member profiles or posts. Open reports and the moderation log are never deleted by it. And the notification log setting permanently removes older entries, so choose it on purpose.

How does a member get a copy of their data?

This is the right of access. In BuddyNext, a member opens their account, goes to the Privacy or Your data section and chooses Export under “Export my data.”

A file downloads with a copy of their profile, activity and connections. Exporting is read-only. It doesn’t change or remove anything in the community.

The owner can turn this control off. Our docs advise leaving it on unless you have a specific reason and another process for handling requests. If you do turn it off, tell members how else to reach you with a data request, because the right doesn’t go away when the button does.

What happens when a member deletes their account?

This is the right to erasure. A member opens the same section, chooses Delete account and confirms. It can’t be undone.

BuddyNext treats this as a full erasure, and there is no “keep my content” option:

• Profile data, preferences, follows, connections and blocks are erased.
• Posts and comments are permanently deleted with the account. They are removed, not hidden.
• The member is signed out and sent to the home page.

There is also a developer-level detail that matters if you rely on WordPress tools. Every member-delete path in BuddyNext runs one purge, including the WordPress GDPR eraser. So whether a member deletes themselves, an admin deletes them, or you run the WordPress eraser for a request, the same cleanup happens. That came in BuddyNext 1.0.4. See the what is new in 1.0.4 notes.

Two small points. Administrators can’t delete their own account through the member tool, so you can’t lock yourself out by accident. And admins can always delete any account, even when the member-facing control is off.

What this doesn’t cover: copies of data outside your site. Backups still hold old data until they roll off. Mail you’ve already sent sits in inboxes. Any processor that received data keeps its own copy under its own terms. Write your backup retention into your privacy notice, and know how long it is.

How do you control who sees what?

Data protection isn’t only about requests. It’s also about not showing people’s information to the wrong audience. BuddyNext has controls at three levels.

The whole community. Under Privacy and Data, the Private community switch (“Require login to view the community”) sends every logged-out visitor to the login page. No feed, directory or space is visible until someone signs in. It is off by default. This also covers search engines and shared links.

Each space. Every space is Open, Private or Secret. Open spaces can be read by anyone. Private spaces are listed but gated, and non-members can’t read the content. Secret spaces don’t appear anywhere and are invite only. See the space privacy docs.

Each member. Under Settings, Privacy, members choose who can see their profile, who can follow or mention them, whether they appear in the member directory, whether search engines may show their profile and whether to keep their account private. Each change saves as they make it.

Our private community guide walks through the registration modes and the login wall in more detail.

What about cookies?

Cookie rules depend on where your visitors are and what your site sets. BuddyNext itself only sets essential cookies, such as the one that keeps members signed in. Your theme, analytics, ads or embedded video may set others, and those are your call to check.

If you need a consent prompt, switch on the notice under Privacy and Data. It shows once, on a visitor’s first visit, and remembers the choice when they accept. You can change the notice text, the button label and the privacy policy link label from the admin screen. If your site has a Privacy Policy page set in WordPress, the notice links to it.

This notice is a simple “got it” prompt. If your legal advice says you need granular consent categories or blocking of scripts before consent, use a dedicated consent tool for that. We don’t claim the built-in notice does more than it does.

Which third parties become your processors?

This is the part owners most often miss. Self-hosting removes the community vendor, but it doesn’t remove every outside company. Each one that handles member data needs to be in your privacy notice, and most need an agreement with you.

Always on your list:

• Your host. It stores the database and the uploads.
• Your outgoing email service. Sign-up, verification and notification emails pass through it.
• Backup storage, if backups go to a separate provider.
• A CDN or firewall, if you use one in front of the site.

Added if you switch on the matching features. Each of these is an opt-in in BuddyNext Pro:

• Stripe or PayPal, for paid membership plans and checkout. They handle payment details and billing data.
• Firebase Cloud Messaging, for Pro web push notifications. Push needs a Firebase project of yours.
• An AI provider, if you enable AI features. Smart replies and AI moderation use the provider you connect in WordPress, and semantic search uses its own embedding provider (OpenAI is the only working one today). AI features are off by default.
• A realtime server, if you run Pro live updates. They use a Pusher-protocol server, which can be a hosted service or one you run yourself.

The free tier on its own adds none of these. See the free vs Pro page for which features are Pro. If you never enable a feature, its service isn’t a processor for you.

One more point on secrets. Since Pro 1.2.1, provider credentials such as the Firebase service account, the realtime secret, Stripe and PayPal secret keys and the AI embedding key are encrypted before they’re stored in the options table. A plain database export no longer shows them. That’s good hygiene, and it isn’t a compliance claim.

How do hosted platforms compare?

Hosted platforms such as Circle, Skool and Mighty Networks store member data on their own servers. In GDPR terms, each is your processor. Most publish a data processing agreement and list their sub-processors and the regions they use.

That route has real benefits. The vendor runs security, uptime and updates for you, and a clear DPA can save you time. What you give up is the choice of location and the ability to inspect or move the data on your own terms.

We can’t speak for what each vendor commits to, and their terms change. Before you choose one, read its DPA, its sub-processor list and its data location statement on its own site. Ask what export it offers if you leave.

Which self-hosted options have an EU angle?

You have good choices beyond us. Here is a fair look at the ones people usually weigh.

HumHub is a strong pick. It’s a standalone, open-source social network and intranet kit. You can self-host it, and it also offers a managed option on EU servers if you’d rather not run the server. It’s built for intranets and organizational networks, and its paid editions add LDAP, SAML and JWT sign-in. If you need a dedicated team network that isn’t tied to a website, it’s a complete option. Check its site for the current editions.

Discourse is the gold standard for discussion forums. It’s fully open source and runs on its own stack, so you can self-host it on a server in the country you pick. The company also sells managed hosting. If your community is mostly long threads and Q&A, it is hard to beat.

BuddyPress is the free, community-maintained option on WordPress. Privacy tools beyond the basics often come from add-ons, so check what you’d need.

Both HumHub and Discourse are separate applications from WordPress. That means a second system to host, secure and update next to your website. BuddyNext is the fit when your site is already WordPress and you want the community inside it, with one login, one theme and one database. Our HumHub comparison and Discourse comparison go through the differences.

What should you check before you launch?

Use this as a starting checklist. It isn’t complete, and your lawyer may add items.

1. Choose the host and region. Write down where the data will live.
2. Sign a data processing agreement with your host and your email service.
3. Write the privacy notice. Cover what you collect, why, who receives it and how long you keep it. Link it from sign-up.
4. Decide your registration mode. Open, Invite Only, Admin Approval or Closed. Collect only the profile fields you need.
5. Set retention. Pick your report retention and notification log periods under Privacy and Data.
6. Leave export and deletion on, or write down your alternative process.
7. Turn on the cookie notice if your law or advice calls for it, and check what else your site sets.
8. Set search indexing. Choose Everything, Public posts only or Nothing, and consider the login wall for a private community.
9. List every Pro service you enable as a processor: payments, push, AI and realtime.
10. Test a request end to end. Export a test member’s data, then delete the test account and confirm it is gone.
11. Plan backups. Know how long old copies stay around and say so in your notice.
12. Name who answers requests, and how fast.

You can run steps 4 to 10 in the live demo. It runs for four hours, gives you owner access and asks for an email.

Who should be careful before relying on this?

A few honest limits.

• If you need a certified or audited setup, such as for health or financial data, a general community plugin isn’t enough on its own. Talk to a specialist.
• If you have no one to run a server, a hosted platform with a clear DPA may carry less risk for you than a site you don’t maintain.
• If your members are children, extra rules apply in many places. Get advice first.
• If you need granular consent management, pair the site with a dedicated consent tool.

BuddyNext gives you the controls. You still own the decisions. If you want a community you host in a country you choose, with export, erasure and privacy settings built into the free core, start with the privacy and data docs and the live demo, then take the legal questions to someone qualified.