I work at a small company that non the less deliver EDRMS system to a large part of the public sector. GDPR is intentionally vague, and most of it seems to be t

I work at a small company that non the less deliver EDRMS system to a large part of the public sector. GDPR is intentionally vague, and most of it seems to be that you have to show reasonable effort. The backup problem require some additional logic and procedure, but that is the least of the problems. One of my main issues with GDPR is the increased Red Tape. If I need customer data for whatever reason, extract data and deliver to Risarkivet (required by law every now and then), I must get a Data Processor Agreement. Fair enough, except if I need to do a different thing the customer asks me for, I need a new DPA. Only thing that'll happen is that we have a standard made by Datatilsynet, put in customer details and job detail, and that is it. A mail provides exactly the same, it could even reference the standard DPA. That just isn't accepted by the law. I guess middle managers need something to do as well.