4 ms·

I can't really see how it's so burdensome for small firms? It's tauted as a truth every time GDPR is mentioned, but why? If you ask me, being ready for GDPR is

I can't really see how it's so burdensome for small firms? It's tauted as a truth every time GDPR is mentioned, but why? If you ask me, being ready for GDPR is much harder for big companies with legacy systems, bureaucracy etc. And I find that letter easy to answer. If companies don't, that just makes GDPR even more necessary.

Matticus_Rex 9y ago
Reasons it has cost my small company hundreds of thousands of dollars: Hundreds/thousands of hours of time (over a thousand for sure by May 25th, and it doesn't stop there) of very expensive employees to understand what compliance means and work toward achieving it (law/privacy professional, developers, training time for all employees) New software tools for specific compliance requirements (documentation, etc.) Consulting and new services needed (EU representative, etc.) Cost of EU servers (this is NOT required for compliance, but so many of our customers have a bad understanding of what the GDPR requires of them that we found we would lose tens of thousands in ARR if we didn't bring up an EU server stack). I've spoken with friends at big megacorps, and the challenges are massively different. At our company, we need almost everyone to understand quite a bit of the GDPR. We also can't build giant custom solutions -- like many SMBs, we are essentially a framework built around a chain of dozens of third party services that all have their own GDPR needs, from G Suite to Mailchimp to github to our bookkeeping and accounting contractors. The job of GDPR compliance just doesn't scale proportionately from 1 employee to 1000 -- there's a base level before the scaling starts, and the scaling from there isn't even 1:1.
- M2Ys4U 9y ago
  That's the cost of introducing the GDPR. Once the GDPR has been around for a few years, everybody in the workforce will (or at least should) know what it is and how it works. The cost of training will only felt when somebody enters the workforce.
  - Matticus_Rex 9y ago
    Even if you think it's worth the cost, you can't deny that there are still ongoing costs; doing something a less efficient way bears a cost, and more auditing, documentation, and overhead bears a cost.
    - M2Ys4U 9y ago
      The cost of doing it is a small negative effect on some (predominantly older) companies' bottom lines. The cost of not doing it is widespread violation of our fundamental human right to privacy. It's definitely worth it.

Matticus_Rex 9y ago

Reasons it has cost my small company hundreds of thousands of dollars: Hundreds/thousands of hours of time (over a thousand for sure by May 25th, and it doesn't stop there) of very expensive employees to understand what compliance means and work toward achieving it (law/privacy professional, developers, training time for all employees) New software tools for specific compliance requirements (documentation, etc.) Consulting and new services needed (EU representative, etc.) Cost of EU servers (this is NOT required for compliance, but so many of our customers have a bad understanding of what the GDPR requires of them that we found we would lose tens of thousands in ARR if we didn't bring up an EU server stack). I've spoken with friends at big megacorps, and the challenges are massively different. At our company, we need almost everyone to understand quite a bit of the GDPR. We also can't build giant custom solutions -- like many SMBs, we are essentially a framework built around a chain of dozens of third party services that all have their own GDPR needs, from G Suite to Mailchimp to github to our bookkeeping and accounting contractors. The job of GDPR compliance just doesn't scale proportionately from 1 employee to 1000 -- there's a base level before the scaling starts, and the scaling from there isn't even 1:1.

M2Ys4U 9y ago
That's the cost of introducing the GDPR. Once the GDPR has been around for a few years, everybody in the workforce will (or at least should) know what it is and how it works. The cost of training will only felt when somebody enters the workforce.
- Matticus_Rex 9y ago
  Even if you think it's worth the cost, you can't deny that there are still ongoing costs; doing something a less efficient way bears a cost, and more auditing, documentation, and overhead bears a cost.
  - M2Ys4U 9y ago
    The cost of doing it is a small negative effect on some (predominantly older) companies' bottom lines. The cost of not doing it is widespread violation of our fundamental human right to privacy. It's definitely worth it.