If you mean complying with requests for deletion, exports of personal data or name updates I suppose that can be handled via email as well. Since it's all manual I would assume you can just update the files and re-generate the site.

The only real problem is verifying the legitimacy of requests. How do you know for sure that an email containing a GDPR request came from the same person that also sent the comments? I guess you could come up with some rules. For example, if the request was signed with the same GPG key as the original comments or if a request passes DMARC...

I'm curious to hear what the author thinks of that!

Addendum: If you track your website's sources in a public VCS and include comments in there you probably have to run a "filter-branch" (or whatever your VCS has for that) over it to purge PII from the version history.

> Art. 2 GDPR: This Regulation does not apply to the processing of personal data: [...] (c) by a natural person in the course of a purely personal or household activity

The fact that the database is connected to the internet and shows the real names of people publicly means that this article is unrelated.

That is a valid concern. I had someone send a GDPR request to have their data removed, on my small website / newsletter.

It does and can happen. Albeit, not often.

why?