> "the contractor said they're compliant" this part wont work w/ GDPR - this is not the US. I've mentioned it someplace else - the contracts with the contracto

> "the contractor said they're compliant" this part wont work w/ GDPR - this is not the US. I've mentioned it someplace else - the contracts with the contractors have quite explicit clauses about liabilities about data breaches/leaks as the fines would still be applied to the main entities. With regard to GDPR, personal data is a liability and it should be handled with appropriate care.