> I don't think this is the case at all. Essentially all personal data is sensitive. Noooooo, not according to this or any other privacy law. Under the GDPR, i

> I don't think this is the case at all. Essentially all personal data is sensitive. Noooooo, not according to this or any other privacy law. Under the GDPR, it's "data consisting of racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person's sex life or sexual orientation." > Are there likely scenarios in which data is collected and processed in a responsible manner, but technical GDPR compliance is a huge burden? Yes. My company, and most companies of other privacy professionals I've talked to. > Why would this be the case? Most of the administrative requirements appear to be entirely justified methods to ensure that you have understood and evaluated the methods of compliance. If you think that any cost is justified to ensure that something that ought to be done is actually being done, sure. By any analysis of costs and benefits, I think you might come to a different conclusion, but that would require some kind of real analysis of costs and benefits. I haven't seen that from anyone who is both (a) a supporter of the law and (b) has actually spent time implementing it in a real, involved business that deals with personal data (and I mean actually implementing it, and not the absurdly simple version many HN commenters seem to be doing that doesn't include massive amounts of documentation).