2 ms·
> Or submit to any other conflicting regulatory regime? I'm pretty sure the regulations have a catchall "you are allowed to store the data if legally required
by IanCal 6y ago
> Or submit to any other conflicting regulatory regime?
I'm pretty sure the regulations have a catchall "you are allowed to store the data if legally required to" for exactly these kinds of issues. Need to store the data for 7 years for tax purposes? Fine.
- theptip 6y agoSure, Article 6, section 1c (https://gdpr-info.eu/art-6-gdpr/); https://gdpr-info.eu/art-6-gdpr/); processing is lawful if "processing is necessary for compliance with a legal obligation to which the controller is subject" I think (like the GP) you're oversimplifying though. Have you ever had to determine what is considered a "legal obligation"? It's not fun. Much to the distaste of us engineers, it turns out that most laws are not written in an unambiguous fashion; many (like HIPAA) are very vague in places, and rely on precedent or tribal knowledge about how the regulator in question tends to interpret things. So yes, if you have a clear, unambiguous requirement to keep Personal Data, then you don't need to lawyer up. If you work in an industry with complex regulations, then you're going to need lawyers and/or consultants to tell you how to resolve the conflict between GDPR and those regulations.