MySQL

What is MySQL

MySQL is the world's most widely deployed open source relational database. It runs on the server side, behind your application, and is used to persist user accounts, orders, content, logs and any other structured data. Originally developed by MySQL AB in Sweden and now owned by Oracle, it is offered both as a free community edition and as commercial editions. Most major cloud providers expose managed variants such as Amazon RDS for MySQL, Google Cloud SQL, Azure Database for MySQL and DigitalOcean Managed Databases.

What data MySQL stores

MySQL itself is neutral storage: the personal data it contains depends entirely on what your application writes to it. In typical web applications this includes emails, hashed passwords, full names, addresses, IP addresses, payment references, support tickets and behavioural logs. MySQL also keeps server logs (general log, slow query log, binary log) that may incidentally contain personal data embedded in SQL queries.

GDPR and ePrivacy implications

As soon as MySQL stores information about identified or identifiable natural persons, the GDPR applies. You become a controller (or joint controller) for that data. Key obligations include having a valid legal basis, applying data minimisation, defining retention periods, securing the database with encryption at rest and in transit, restricting access, and being able to honour data subject rights such as access, rectification, erasure and portability. The ePrivacy Directive does not apply to MySQL directly because it is not a terminal equipment storage technology, but it covers the cookies your application sets on top.

Consent and legal basis

Storing operational data in MySQL does not require browser consent because the database lives on your server, not on the user device. The legal basis is typically contract performance (Art. 6(1)(b) GDPR) for the data needed to deliver the service, or legitimate interest (Art. 6(1)(f) GDPR) for security logs and fraud prevention. Special category data (health, religion, biometrics) requires an explicit Art. 9 GDPR basis, usually consent or a specific legal obligation.

Data transfers and hosting choices

MySQL is hosting agnostic. Where the data ends up depends on the region of your virtual machine, your managed database or your colocation provider. To avoid international transfer issues, pick an EU region and verify it covers backups, replicas and disaster recovery sites. If you use AWS RDS, Google Cloud SQL or Azure Database for MySQL operated by a US headquartered provider, you must rely on the EU US Data Privacy Framework or on Standard Contractual Clauses together with a documented transfer impact assessment.

Practical compliance steps

Map every table that stores personal data. Document purpose, legal basis and retention for each. Enforce TLS for client connections, enable encryption at rest (InnoDB tablespace encryption or filesystem level), restrict privileges with the principle of least access, pseudonymise identifiers where you can, schedule automated purges of expired data, and back the database up to a region with the same data protection guarantees. Add MySQL to your records of processing activities (Art. 30 GDPR) and to your incident response runbooks.