3 ms·

... and document every instance of processing, as well as the legal basis for processing for each use of each piece of data, and how you decided that legal basi

... and document every instance of processing, as well as the legal basis for processing for each use of each piece of data, and how you decided that legal basis (and if you used "legitimate interest," you need to do a LIA -- the template I use is several pages before you enter the information). Then you have to negotiate different DPA terms with a dozen clients whose privacy lawyers told them they each need a different term because we privacy professionals still have no idea what parts of this law mean. Oh, and then you have to handhold customers who think they know more about privacy law than you do because they read a 500-word rundown of the GDPR, because if you don't nicely convince them they're wrong, they'll make a complaint. There's plenty more, but you get the idea. Anyone who says implementing this law is simple isn't implementing this law in a business of normal size and complication.

DanBC 8y ago
> and document every instance of processing, as well as the legal basis for processing for each use of each piece of data, and how you decided that legal basis But only if that's proportionate. https://gdpr-info.eu/art-24-gdpr/ https://gdpr-info.eu/art-24-gdpr/ > Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. 2Those measures shall be reviewed and updated where necessary. > Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.
- Matticus_Rex 8y ago
  The bar for that is very, very low given the guidance we've received from the supervisory authorities, so that doesn't really minimize my point. An incredibly small number of businesses would be able to argue that this doesn't apply to them.

DanBC 8y ago

> and document every instance of processing, as well as the legal basis for processing for each use of each piece of data, and how you decided that legal basis But only if that's proportionate. https://gdpr-info.eu/art-24-gdpr/ https://gdpr-info.eu/art-24-gdpr/ > Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. 2Those measures shall be reviewed and updated where necessary. > Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.

Matticus_Rex 8y ago
The bar for that is very, very low given the guidance we've received from the supervisory authorities, so that doesn't really minimize my point. An incredibly small number of businesses would be able to argue that this doesn't apply to them.