As far as I can tell, everyone who supports GDPR knows nothing about it. GDPR is vastly more complex than "if you just have a user login it's easy". To pick j

As far as I can tell, everyone who supports GDPR knows nothing about it. GDPR is vastly more complex than "if you just have a user login it's easy". To pick just one non-login related problem that has cropped up for me in the past month, a job candidate got upset after a rejection and asked us to "erase him from our database" - probably meaning our recruitment mailing lists. But the recruiters decided this was a GDPR "right to be forgotten" request and proceeded to erase all mention of him from our applicant tracking database. I was then quite confused when he approached me and said he'd been interviewed, because as far as I could tell we'd never talked to him about it. Of course, the whole idea that job candidates can simply make a company "forget" that they interviewed them is absurd to start with but it's the sort of thing that happens due to GDPR. And then there's the perenially enjoyable question of whether backups are now illegal, or to what extent they're illegal. Oh, and please don't give me any lectures about how GDPR doesn't require this. GDPR is such a badly written piece of law that it's impossible to say what it does or doesn't require. Anyone who thinks they know just doesn't understand how the regulation works.