> You need to research the right to be forgotten as it applies to news articles, it doesn't work in the way you describe. I was referring to Google vs. Costeja

> You need to research the right to be forgotten as it applies to news articles, it doesn't work in the way you describe. I was referring to Google vs. Costeja, which I realize isn't GDPR, but an EU court did rule that way. > You don't need a compliance officer, but you do need a security officer I strongly believe that compliance and security are two very different things, that are only slightly related. They come at it from a very different perspectives. A security engineer should be doing threat modeling and protecting against threat vectors. A compliance officer may consult a security engineer, but ultimately their job is to check boxes to make sure regulations are followed. I think compliance staff are more appropriately part of a legal team than an engineering team. That isn't to say compliance officers aren't useful. Having a strong compliance voice can be great. I've seen companies without a compliance officer reduce security because an auditor told them regulations required something. A good compliance officer would have been able to push back against the auditors, pointing out what regulations actually require, and working with the security engineers to come up with a solution that meets regulations and actually improves security.