3 ms·

GDPR is pretty harmless and relatively easy to implement I think

KingOfCoders 5y ago
What was particullary easy implementing GDPR for you? I found some areas particullary hard. Legitimate interest is a minefild and mostly can't be used, except e.g. delivery addresses. Finding GDPR compliant companies - with the US out of question - was also hard. Tracking and deleting data on request when storing in dozens of systems was hard - even returning all the data stored in dozens of external SaaS companies was hard (logging what you send them helps here, but doesn't address their tracking generation). They often don't give you everything you store with them back - deletion is often much easier. Tracking data in backups that needed to be cleaned on restore due to deletion requests was difficult to implement - easy in one, complicated in dozens of systems. Especially hard with AWS. These are the most challenging I had on hand when implementing GDPR.
- cutemonster 5y ago
  > What was particullary easy implementing GDPR for you? Deleting people's private data upon request, namely when they click a button -- in my case (unlike yours) there's not many places to delete the data from. The most challenging thing is instead writing a DPA, and wondering what to write about inspections and auditing, in a remote only company with servers in the cloud (any thoughts about that?)
  - KingOfCoders 5y ago
    I think auditing is an unsolved problem for now, I haven't heard of any implementation that works. I would assume special companies will arise that do the auditing for you - and that work with AWS and GCP for you.
    - cutemonster 5y ago
      > special companies will arise that do the auditing for you I think so too -- I had a look at Google's DPA and it seemed to me that when one agrees to Google's DPA, one agrees to trust some Google approved companies to do the auditing for everyone (for all Google cloud customers). Maybe there's not any other way to make it work (it'd be crazy with random people in their datacenters "auditing" things)

What was particullary easy implementing GDPR for you? I found some areas particullary hard. Legitimate interest is a minefild and mostly can't be used, except e.g. delivery addresses. Finding GDPR compliant companies - with the US out of question - was also hard. Tracking and deleting data on request when storing in dozens of systems was hard - even returning all the data stored in dozens of external SaaS companies was hard (logging what you send them helps here, but doesn't address their tracking generation). They often don't give you everything you store with them back - deletion is often much easier. Tracking data in backups that needed to be cleaned on restore due to deletion requests was difficult to implement - easy in one, complicated in dozens of systems. Especially hard with AWS. These are the most challenging I had on hand when implementing GDPR.

cutemonster 5y ago
> What was particullary easy implementing GDPR for you? Deleting people's private data upon request, namely when they click a button -- in my case (unlike yours) there's not many places to delete the data from. The most challenging thing is instead writing a DPA, and wondering what to write about inspections and auditing, in a remote only company with servers in the cloud (any thoughts about that?)
- KingOfCoders 5y ago
  I think auditing is an unsolved problem for now, I haven't heard of any implementation that works. I would assume special companies will arise that do the auditing for you - and that work with AWS and GCP for you.
  - cutemonster 5y ago
    > special companies will arise that do the auditing for you I think so too -- I had a look at Google's DPA and it seemed to me that when one agrees to Google's DPA, one agrees to trust some Google approved companies to do the auditing for everyone (for all Google cloud customers). Maybe there's not any other way to make it work (it'd be crazy with random people in their datacenters "auditing" things)