4 ms·

The GDPR deletion requirement has been most compelling (and a headache) for my application

allan_s 3y ago
IANAL but I got confirmed several time that you can soft delete if all fields are then anonymized, the law does not care about the concept of database row as long as the PII is deleted
- Detrytus 3y ago
  If you anonymize data then it isn't soft delete anymore as you cannot un-delete it. What you are describing is more suited to generating test data for machine learning algorithms, or simply for developers that need to set up db instance in DEV environment.
  - allan_s 3y ago
    Yes i agree, my point was not clear. I meant to adress their "due to rgpd you are obliged to delete row so you are back again with the foreign key constraint problem" which is a often misunderstanding of developers that think that the "delete" meant by the law is bijective to a sql DELETE statement
rawgabbit 3y ago
To satisfy GDPR requirements when customers leave, you can blank out the PII fields. No need to blow up your application by deleting records.
- taeric 3y ago
  Also, a lot of records are the businesses? They may have to remove who it was that they did business with, for compliance, but they do not have to forget that they did business? (Right? Genuine question.)
  - rawgabbit 3y ago
    Not a lawyer. Please consult with one. The general rule is you must comply with all laws and regulations that impacts you. Tax regulations and contract laws and employment laws usually override the duty to delete PII when customers leave. Each set of laws have a generally defined retention period. Please keep in mind each country’s laws are different. Your lawyer can tell you what they are. What that means is if you blank out or anonymize the record you can argue you are satisfying generally accepted record keeping rules. Eg you sold a widget to a person. To satisfy GDPR you just don’t know who they are after so many years.
    - taeric 3y ago
      Right, this matches my understanding. With the same caveats.

IANAL but I got confirmed several time that you can soft delete if all fields are then anonymized, the law does not care about the concept of database row as long as the PII is deleted

Detrytus 3y ago
If you anonymize data then it isn't soft delete anymore as you cannot un-delete it. What you are describing is more suited to generating test data for machine learning algorithms, or simply for developers that need to set up db instance in DEV environment.
- allan_s 3y ago
  Yes i agree, my point was not clear. I meant to adress their "due to rgpd you are obliged to delete row so you are back again with the foreign key constraint problem" which is a often misunderstanding of developers that think that the "delete" meant by the law is bijective to a sql DELETE statement

rawgabbit 3y ago

To satisfy GDPR requirements when customers leave, you can blank out the PII fields. No need to blow up your application by deleting records.

taeric 3y ago
Also, a lot of records are the businesses? They may have to remove who it was that they did business with, for compliance, but they do not have to forget that they did business? (Right? Genuine question.)
- rawgabbit 3y ago
  Not a lawyer. Please consult with one. The general rule is you must comply with all laws and regulations that impacts you. Tax regulations and contract laws and employment laws usually override the duty to delete PII when customers leave. Each set of laws have a generally defined retention period. Please keep in mind each country’s laws are different. Your lawyer can tell you what they are. What that means is if you blank out or anonymize the record you can argue you are satisfying generally accepted record keeping rules. Eg you sold a widget to a person. To satisfy GDPR you just don’t know who they are after so many years.
  - taeric 3y ago
    Right, this matches my understanding. With the same caveats.