3 ms·
TL;DR: It's a spreadsheet to help you list out what personal data you keep in your organization, who has access to it, how it's secured, how long you plan on ke
by michaelbuckbee 8y ago
TL;DR: It's a spreadsheet to help you list out what personal data you keep in your organization, who has access to it, how it's secured, how long you plan on keeping it and what you intend to do with it.
MORE: I'm not trying to be dismissive, it's great! And whether or not you're going full-on trying to get GDPR compliant or not, it's _really_ hard to think of a scenario where taking the time to think and document your data handling and security isn't a net positive for the security posture of your application.
When you dig into the GDPR [1] you find that a lot of it is like this: common sense stuff that you'd hope everyone was doing already, but apparently aren't.
- Tell People what you're going to do with their data
- Don't do other stuff with it than what you told them
- Keep it secure
- Don't give it to other companies that might do things with it you didn't tell people about
- If you lose control of it in a data breach: tell them
- If they ask you for their data, give it to them
- If they ask you to delete their data, delete it
1 - https://blog.varonis.com/gdpr-requirements-list-in-plain-english/ https://blog.varonis.com/gdpr-requirements-list-in-plain-eng...
- rdlecler1 8y agoIt’s the implementation that is difficult. For example, if someone wants their data deleted I need to go delete all of the email correspondence, I need to delete them from applications like Google Analytics. If I follow them on Twitter or interacted with the on Twitter I need to delete those posts. Oh and then there are backup archives that I now need to scrub. The point being is a lot of data is not well assembled and cleaned for deletion which is why data analytics on your existing data is so hard in the first place!
- Matticus_Rex 8y agoAnd the difficulty can rise exponentially if you have a giant stack that wasn't designed with GDPR in mind (though it may be totally benign in its risk towards data subjects) and which cannot be easily disentangled to comply with some of these requirements.
- linker3000 8y agoOpinion on the matter: "The GDPR however does make a small concession to companies in this case: the steps they need to take in this direction are limited to the available technology and the cost of its implementation. Organizations must take reasonable measures to ensure processors are aware of the request, but will not be at fault if the data is not completely erased by third parties." https://www.endpointprotector.com/blog/gdpr-essentials-the-right-to-erasure-who-can-request-it-and-how-is-it-applied/ https://www.endpointprotector.com/blog/gdpr-essentials-the-r...
- Matticus_Rex 8y agoThe vaguery there is the problem. I know how I would decide if it were up to me, but if a supervisory authority comes calling, that's just my argument, and they almost certainly have a preset opinion about what is reasonable.
- linker3000 8y agoIt's unlikely you will need to scrub backup archives: http://www.gdprarticles.com/gdpr-articles/data-subject-rights/gdpr-right-to-be-forgotten-include-backups/ http://www.gdprarticles.com/gdpr-articles/data-subject-right...
- ec109685 8y agoThis more evidence that a hard consent is legal (from a conversation we had a few weeks ago on HN): https://twitter.com/maxschrems/status/998681336427827201?s=21 https://twitter.com/maxschrems/status/998681336427827201?s=2...