3 ms·
GDPR as applied is a joke. At one of the places I work they keep talking about "we can't backup this data anymore because it has personal info".
by twobat 7y ago
GDPR as applied is a joke. At one of the places I work they keep talking about "we can't backup this data anymore because it has personal info".
- tsimionescu 7y agoThat's not enforcement, that's misreading...
- akvadrako 7y agoNot really - you need a way to scrub user data on demand from backups and they should also have limited duration.
- matthewmacleod 7y agoYou do not require a way to “scrub user data on demand from backups”. This is just untrue; please don’t spread it.
- akvadrako 7y agoWhat are you talking about? Part of GDPR is deleting personal data on demand.
- matthewmacleod 7y agoYou have misunderstood the requirements of the GDPR. CNIL, for example, has made it explicitly clear that so long as an effective retention policy is in place then PII does not need to be removed from backups on demand.
- akvadrako 7y agoIf by that you mean backups need to be deleted after a certain period then it's effectively the same thing.
- steve_gh 7y agoWell that's just a crock. You simply have to have a policy that says how long you retain backups for, and what you would do if you needed to delete PI if required to do so under GDPR. It's not rocket science!