I had to do a deep dive on all of this and I found the actual letter of the law to be readable and in some cases surprisingly well written. You're surely lookin

I had to do a deep dive on all of this and I found the actual letter of the law to be readable and in some cases surprisingly well written. You're surely looking for a quick one way or another answer and there's lots of comments with their own takes so I won't rehash any of that. Just a plug for reading the actual law like you would read the source code. There are entire sections you can skip about requirements the regulators are under and you can focus on the burdens on data processors and controllers which is effectively what you would be classified as. Have fun, it's really not so bad. https://gdpr-info.eu/ https://gdpr-info.eu/