GDPR Compliance of New User Approve

That’s a good question. The New User Approve plugin doesn’t store any personal user data outside of what WordPress stores. It seems like that falls onto each site owner to make sure their site is compliant.

I am still researching this with regards to what the plugin needs to be GDPR compliant outside of what each individual site owner needs to do.

OK, so it looks like that ONCE the WordPress platform will be GDPR compliant, also your plug-in will be, since you use what WP already stores. Is my understanding correct?

@dejudicibus:
WP 4.9.6 was released yesterday makes the first steps WP being GDPR compliant by letting you define a “Privacy Policy” page (they even included a sample text that is good enough to let you understand what exact data you have to include). WP core even delivers a “Personal Data Export” and “Personal Data Deletion” tool. However on the frontend there is simply no means for the user to inquire any activity from the administrator. So you just need to include an email address in the privacy policy page where users can submit such requests. Maybe you even can setup a contact forms for these purposes.

Being told all that it is obvious that WP has just began with the first steps and there are quite a few to be done if in the future. The most complete GDPR solutions this day seems to be: GDPR plugin

The only thing extra we are storing on a user is if they have been accepted or denied as a status. And that is stored in the standard WordPress database structure. If the user wants this data removed with the other data, that will happen.