3 ms·
I think the US implementing something similar is inevitable. If not by the government than by a privacy company (like PCI is for the card industry). Already I'
by throwaway2016a 9y ago
I think the US implementing something similar is inevitable. If not by the government than by a privacy company (like PCI is for the card industry).
Already I've started to see contracts with credit card gateways include PrivacyShield clauses.
Personally, all products I build going forward will be GPDR and Privacy Shield compliant even though I am in the US. I recommend other entrepreneurs do the same because it is probably easier to consider it now than it is to do it later.
For example (to give context we have PCI requirements to) when someone makes a change to the code we have a impact assessment that needs to be filled out. Among those are the questions:
1. How will this change impact security?
2. How will this change impact customer privacy?
We fill it out for every single change request (even if the answer to both is "It doesn't) just to document that we are thinking about it and engrain thinking about it into the company culture.
- r00fus 9y agoWhats to prevent the ticket creators / assignees from simply saying "no impact " by habit? The danger for these kinds of controls is that you're trained to say "no impact " many times (because there is none most of the time)
- throwaway2016a 9y agoThis is something filled out by the security and devops team not by the ticket creator. Also, best practice would be to have "No impact" require an explanation not just simply a two word brushoff. Edit: Also at some point you have to trust your team, hire the right type of people, and embed it in the company culture that the analysis is something to be taken seriously. If leadership takes it seriously the people filling out the forms aren't going to brush it off.