> Being forced to appoint a "Data Protection Officer" can definitely be burdensome to small businesses or startups that are already on the margin. You don't ha

> Being forced to appoint a "Data Protection Officer" can definitely be burdensome to small businesses or startups that are already on the margin. You don't have to. Someone needs this responsibility but is doesn't have to be a specific person. For us the DPO only exists as a mailing address for a subject access request, the role is shared. > -The "Right to Erasure" for one - any user can force you to delete some of your data at any time. But only for data you have no real use for, or it would be exempt. The flexibility of the wording works both ways.