7 ms·

Hey I have no idea what your business is, but every case I've come across where people worry about GDPR is clearcut. As you say, you must absolutely hold onto

Hey I have no idea what your business is, but every case I've come across where people worry about GDPR is clearcut. As you say, you must absolutely hold onto transaction history for tax purposes, at least! That said, unless you're selling arms or something (if compliance with the law is ambiguous go see a lawyer) you must honour an individual's right to be forgotten. You can do this without deleting records of transactions with that individual. You would however note that you can no longer identify the buyer because of such request x on date y. That should be as simple as deleting PII and then ammending the transaciton record with a comment. Your biggest challenge here is how to handle the customer record. Do you delete it outright, and point the buyer field in the transaction record at a single GDPR ghost customer, or do you overwrite the customer data with random, non-PII values (I've always gone with the former)? If your architecture is solid then these change requests should form part of ongoing BAU, no? Submit change request, develop, test, deploy...

Silhouette 9y ago
You can do this without deleting records of transactions with that individual. You would however note that you can no longer identify the buyer because of such request x on date y. Instant EU VAT law violation if you do this without retaining the required proof of customer location for at least 7 years. Formal tax investigation(s) to follow if you're big enough to be interesting and doing this systematically, possibly by up to 28 different member states' tax authorities depending on how much tax revenue each suspects that you have avoided paying them. Good luck. :-) If your architecture is solid then these change requests should form part of ongoing BAU, no? Submit change request, develop, test, deploy... And again I come back to my recurring theme that for many smaller organisations, almost every term you mentioned in that paragraph might as well be written in a foreign language. Small organisations don't have dedicated staff or established formal processes for running a lot of their day-to-day activities, never mind things like regulatory compliance.

Silhouette 9y ago

You can do this without deleting records of transactions with that individual. You would however note that you can no longer identify the buyer because of such request x on date y. Instant EU VAT law violation if you do this without retaining the required proof of customer location for at least 7 years. Formal tax investigation(s) to follow if you're big enough to be interesting and doing this systematically, possibly by up to 28 different member states' tax authorities depending on how much tax revenue each suspects that you have avoided paying them. Good luck. :-) If your architecture is solid then these change requests should form part of ongoing BAU, no? Submit change request, develop, test, deploy... And again I come back to my recurring theme that for many smaller organisations, almost every term you mentioned in that paragraph might as well be written in a foreign language. Small organisations don't have dedicated staff or established formal processes for running a lot of their day-to-day activities, never mind things like regulatory compliance.