3 ms·
In Europe, we have GDPR which is broadly similar. And the answer to your question about logs is basically "Tough shit. Personal data is important and if you've
by codeulike 7y ago
In Europe, we have GDPR which is broadly similar. And the answer to your question about logs is basically "Tough shit. Personal data is important and if you've been leaving it in logs all over the place then you're going to have to sort that shit out".
The Backups question is a bit more complex. One source I've seen: "According to France’s GDPR supervisory authority, CNIL, organisations don’t have to delete backups when complying with the right to erasure. Nonetheless, they must clearly explain to the data subject that backups will be kept for a specified length of time (outlined in your retention policy)."
Paired with that is that if you're keeping data (or backups) for any length of time beyond the immediate needs of the customer then you need to be able to justify it.