A “GDPR Guy” isn’t necessarily snake oil if you had a person or a team that their job was to work with a DPA prior to the GDPR to implement previous data protec

A “GDPR Guy” isn’t necessarily snake oil if you had a person or a team that their job was to work with a DPA prior to the GDPR to implement previous data protection regulations. That relationship is very important as it’s essentially a lobby. However beyond that it’s very hard to definitely make any claims and currently also use lawful basis other than consent that are not tied to pre-existing contracts. Other parts of the law like those which refer to anonymization including pseudo-anonymization, deletion and processing halt are also very tricky to implement currrently in a guaranteed manner. For example if I pseudo or fully anonymize a piece of information what is the benchmark that i need to ensure that it’s complaint? How resilient does it need to be against cross referencing? Specifically for examples how many additional pieces of information does one need to de-anonymize my information before my process is consider non complaint? Do I need only to consider information that i collect or process in this benchmark? Or do I need to evaluate my process against any potential information that can be gathered about a data subject by any other party?