>If you are big enough to have to worry about this you are probably a company with plenty of resources to think and comply with this You'd be surprised. GDPR i

>If you are big enough to have to worry about this you are probably a company with plenty of resources to think and comply with this You'd be surprised. GDPR is vague enough and just open to interpretation enough that there are many different companies interpreting it in many different ways. I'm a consultant and I talk to many multi-nationals and all of them have their own spin on it. Especially around the "except when necessary for security purposes" section. That right there is broad enough that "security purposes" can mean almost anything as long as you make sure your security team has access to that data.