GDPR compliance for US based forums
-
I'm trying to understand the legal implications of allowing EU residents to create accounts on a US based forum. Is it sufficient to place verbiage in the ToS that requires acceptance of data residency in the US?
For example
We care about data privacy and security. By using the Site, you agree to be bound by our Privacy Policy which is incorporated into these Terms of Use. Please be advised the Site is hosted in the United States. If you access the Site from any other region of the world with laws or other requirements governing personal data collection, use, or disclosure that differ from applicable laws in the United States, then through your continued use of the Site, you are transferring your data to the United States, and you agree to have your data transferred to and processed in the United States.
Are there any other clauses that need to be clearly identified? We do state the identifiers collected when creating an account
All data collected is solely for the purpose of providing unique indentifiers in order to allow for the creation of a user account that is then used to access our services. None of this data is shared with 3rd parties, and our own usage is restricted to informational messaging around the operation and functionality of the application. We may ask for and store the following data elements as part of our Sign Up process:
Username (can be fully anonymous)
A valid email address
A valid phone number for dual factor authentication (optional)Any gotchas to be wary of? or any advice in general would be much appreciated.