3 ms·
> Wait a minute… You provide a service, and your users are afraid the GDPR could come to them?!? Yes. It's not unreasonable, because GDPR has components that
by Kalium 8y ago
> Wait a minute… You provide a service, and your users are afraid the GDPR could come to them?!?
Yes.
It's not unreasonable, because GDPR has components that require vendor assurance (more or less). So the megacorp with a point-of-presence in the EU has to be cautious about what strictly-US SaaS services it uses if there's any potential for data crossing into the SaaS.
This is almost certainly exactly what GDPR is intended to do. It aims, in part, to make sure companies can't shirk their responsibilities by handing everything over to vendors who will ignore GDPR.
- loup-vaillant 8y agoAh, OK. Makes more sense now. Still, requiring ISO compliance from a small business sounds like madness. An audit ought to be enough.
- Kalium 8y agoAgain, makes total sense from the perspective of an American legal department. They're falling back on the tools they know to de-risk vendors, which is formal certifications and accreditations. ISO, SOC, etc. The lawyers are going to be extra twitchy because of how vague and hand-wave-y GDPR is. An actual compliance audit from an accredited auditor, paid for by the SaaS offering of course, is not going to be cheap or easy.