4 ms·
I think there are a number of comments being made throughout this whole thread that are conflating the effort required to comply with the best security practice
by chrononaut 8y ago
I think there are a number of comments being made throughout this whole thread that are conflating the effort required to comply with the best security practices to protect user data, compared to the effort required to comply with the language of GDPR. A general theme seems to be that if a company is afraid to do the latter, they must not be willing to do the former.
Which brings up a question, is the complexity of building and offering a GDPR-compliant solution really any different than building a solution that conforms to best security practices? I wouldn't think there is much difference. What is the remaining overhead to comply with GDPR? I am sure just understanding it is a notable piece, but would the developers already be aware of all CWEs, BCPs, existing laws and standards for their components which would also be overhead?
- zerostar07 8y agoGDPR is not about security but about privacy and data access protection. In fact security is mostly on paper: requires that you document the data and procedures, but doesn't require you to upgrade your security. So the effort for the one has little to do with effort for the other.
- chrononaut 8y agoGood point; the sentiment in the original post did mean to include privacy in addition to security.