Short answer: mostly not, as long as you keep it for yourself and your family: the GDPR does not apply to a purely personal or household activity, and it does not cover people who have died. It can apply once you publish details of living relatives for anyone to see, and it always applies to the services that store your archive.
Last updated: 3 November 2026. This page is based on the text of the GDPR on EUR-Lex, checked on that day; the source is at the bottom. It is general information, not legal advice. For a specific case, ask a lawyer or your national data protection authority.
A family tree is full of personal data: names, dates of birth, places, photos, sometimes a cause of death or a divorce. So the question comes up quickly, often from a cousin who has just heard about privacy rules at work. The good news is that the GDPR was not written for families keeping their own history. The details matter, though, especially for living relatives.
The three rules that matter
- The household exemption. Article 2(2)(c) says the GDPR does not apply to processing by a natural person in the course of a purely personal or household activity. Recital 18 explains that this covers activities with no connection to a professional or commercial activity.
- Deceased persons. Recital 27 says the GDPR does not apply to the personal data of deceased persons. Member States may provide their own rules for that data.
- The services you use. Recital 18 also says the GDPR still applies to the controllers or processors that provide the means for those personal activities. The app or website that stores your tree is bound by it, even when you are not.
Common situations at a glance
| Situation | GDPR for you? | Why | Good practice |
|---|---|---|---|
| A family tree on your own computer | Usually no | Purely personal or household activity | Keep a backup, and keep sensitive notes about living people to a minimum |
| Photos and stories shared privately with family and friends | Usually no | Still personal, as long as it stays within your own circle | Invite people one by one rather than sending an open link around |
| Ancestors who have died | No | Recital 27: the GDPR does not cover deceased persons | Check your national rules and other rights, such as copyright on old photos |
| A public website or public tree with living relatives | Possibly yes | Publishing to anyone usually goes beyond a household activity | Hide living people, or ask their permission first |
| Genealogy research for clients, or a paid publication | Yes | That is a professional or commercial activity | Treat it like any business processing personal data |
Living relatives: what to do
For your own archive you do not need consent forms or a privacy notice. Still, a few habits keep everyone comfortable, and they cost little:
- Ask before you share. A cousin may be fine with a family photo in a private room and not fine with it on a public page.
- Leave out what is not yours to tell. Health, adoptions, divorces and debts of living people rarely need to be in a shared archive.
- Hide living people in anything public. Many genealogy services do this by default in public trees. Do the same when you export a GEDCOM file to share.
- Remove on request. If a relative asks you to take a photo or a story out, do it. That is a matter of trust more than of law.
Relatives who have died
The GDPR does not cover them. That does not mean anything goes. Recital 27 allows Member States to make rules about the data of deceased persons, and some do. Old photos can still be protected by copyright or portrait rights, and a story about a grandparent can touch living children and grandchildren. Our guide on posting old family photos online goes into those rules.
The Memory Palace, honestly
The Memory Palace is your own 3D memory palace: photos, voice recordings, videos and written stories hang in rooms you walk through, and your family tree can come in as a GEDCOM file, with each person getting a place next to their photos and stories. It is private by default. You invite family and friends into a room or a wing, and choose per person whether they can view only or also add. Nothing is public unless you share it.
- Your circle, not the internet. Sharing room by room keeps an archive within your own circle.
- Hosted in the EU. As the service that stores your palace, we are bound by the GDPR ourselves.
- You can leave with everything. A full ZIP export on every plan, including the free plan with 1 GB.
What it lacks: it is not a genealogy records database, and it does not tell you what the law allows in your country. It is encrypted in transit and at rest, but not end-to-end. And it is made by a small team in Leuven, Belgium.
A simple way to start
Make a short list of the living people in your tree and decide, per person, what you would show outside the family. If you want to see your tree on one page first, the free family tree chart draws it from a GEDCOM file in your browser. If you want a private place for the tree, the photos and the stories together, you can start a palace.
Read on: can I post old family photos online, keeping your memories private, encryption compared, a family tree app with photos and stories, and all guides on the family tree.
Sources
- Regulation (EU) 2016/679 (GDPR): Article 2(2)(c), purely personal or household activity; Recital 18; Recital 27, deceased persons: eur-lex.europa.eu/eli/reg/2016/679/oj