3 ms·

Yeah, but the analogy is not good... * We've known about the GDPR for around 2 years. * The GDPR text, national regulators' comments, industry opinion, sample

Yeah, but the analogy is not good... * We've known about the GDPR for around 2 years. * The GDPR text, national regulators' comments, industry opinion, sample docs and a plethora of free resources have been readily accessible on the Internet for about the same length of time. Having worked on the GDPR docs for a medium-sized business that builds learning management systems for corporate customers (about 100 live systems + dev and testing platforms where we are a processor of their personal data), it took about 3 weeks-worth of time to re-audit our platforms, complete a more detailed risk/impact assessment and write this all up together with some procedures for handling enquiries. Yes it took time, and we went the extra mile with diagrams and tables because the docs are customer-facing, but handled in a timely fashion, GDPR compliance is not a brick wall to business continuity. If a business already has in place a baseline level of good information security practice, GDPR compliance is not that hard.

consp 8y ago
Also, needing to have a DPO is not difficult since he already has one employee, himself. It's not ISO2700x, you don't need to fiddle around with rights in small businesses to make sure it fits the narrow perspective of a standardization and exclusiveness.
- hanspeter 8y ago
  The DPO cannot be himself.
  - midasz 8y ago
    Source?
  - DanBC 8y ago
    He doesn't need a DPO.
lagadu 8y ago
> * We've known about the GDPR for around 2 years. 6 years, it's a 2012 directive.
nicbou 8y ago
I can't speak for you, but I only heard about GDPR 6 months or so ago, like most people outside of Hacker News. Most small businesses only heard about it in the last 6 weeks. Sure, the regulation was there, but nobody talked about it, and it's unreasonable to expect people to magically learn about EU regulations, especially if they don't live in the EU.

consp 8y ago

Also, needing to have a DPO is not difficult since he already has one employee, himself. It's not ISO2700x, you don't need to fiddle around with rights in small businesses to make sure it fits the narrow perspective of a standardization and exclusiveness.

hanspeter 8y ago
The DPO cannot be himself.
- midasz 8y ago
  Source?
- DanBC 8y ago
  He doesn't need a DPO.

lagadu 8y ago

> * We've known about the GDPR for around 2 years. 6 years, it's a 2012 directive.

nicbou 8y ago

I can't speak for you, but I only heard about GDPR 6 months or so ago, like most people outside of Hacker News. Most small businesses only heard about it in the last 6 weeks. Sure, the regulation was there, but nobody talked about it, and it's unreasonable to expect people to magically learn about EU regulations, especially if they don't live in the EU.