3 ms·
> If i pipe them straight to a logging SaaS, is it on the logging service to handle it? Or is it on me? That’s not gray at all. That’s very clear cut. The SaaS
by the_mitsuhiko 9y ago
> If i pipe them straight to a logging SaaS, is it on the logging service to handle it? Or is it on me?
That’s not gray at all. That’s very clear cut. The SaaS acts as a data processor if it gets IP adresses or other PII.
> Furthermore for the right to be forgotten, how do i handle that with backups that are not under our control?
You need to ensure PII in your database is encrypted already with a per customer key and have these keys be backed up separately where the retention is low.
- geocar 9y agoThe GDPR doesn’t say anything about encryption or IP addresses. The ICO has said that if you have a breech that encryption would protect against them that could be a violation: https://ico.org.uk/for-organisations/guide-to-data-protection/encryption/ https://ico.org.uk/for-organisations/guide-to-data-protectio...
- the_mitsuhiko 9y agoThe gdpr does mention encryption and pseudonymisation. It does not mention ip adresses because the law is very clear about anything being in scope that can be used to identify individuals.
- geocar 9y agoYou’re right. I should have said the GDPR doesn’t require encryption. I blame wee hours commenting. And an IP address cannot always be used to identify individuals.
- the_mitsuhiko 9y agoThat’s why ips are not directly listed in the law.