4 ms·

I've gotten these emails from an MFA vendor. I haven't had the time to review and agree to the new privacy policy they've provided. I'm confused about why a bu

I've gotten these emails from an MFA vendor. I haven't had the time to review and agree to the new privacy policy they've provided. I'm confused about why a business would be impacted by this law, if they are only storing the login data I'm paying for them to store for me. How does the GPDR impact employee auditing requirements? How do I delete your info from my system, and still prove that you only accessed systems to which you were authorized, while you worked for me?

bulatb 8y ago
If the company is storing Personal Data (on people in the EU) or is present in the EU, GDPR applies. They might also be complying voluntarily for various reasons. Data Subjects' rights to their data aren't absolute. If you need it for legal/compliance reasons, or legitimately need to keep it for clearly defensible reasons like auditing, preventing fraud, etc., you aren't required to delete it. But if your only legal basis for processing the data was Subject consent, and they revoke their consent, you are required to delete it. Many companies are treating mailing lists this way and/or are confused and terrified in general, so everyone is getting emails. Some companies are also adding Data Processing Agreements to their terms of service that allow them to be Data Processors for customers. Maybe your MFA vendor is one of those.