4 ms·
Let’s be clear that what you describe is absolutely not gdpr compliant, so it would be illegal if you do business in Europe
by williamdclt 2y ago
Let’s be clear that what you describe is absolutely not gdpr compliant, so it would be illegal if you do business in Europe
- tantalor 2y agoDid you read the whole comment? They say there was a batch script to comply with legal requirements.
- itake 2y ago> but that was not run very often GDPR has strict rules about how long data can persist after the deletion request is made.
- tantalor 2y agoWho knows what "not very often" means. It could mean once a day or once a year. The point is that this could be made to be compliant with little extra effort, so pointing out "um actually it's not compliant" is not saying much.
- cwillu 2y agoThey said they thought there was a script, but it wasn't run very often.
- deleted 2y ago[deleted]
- anyfoo 2y agoDidn’t seem sufficient to me at all, but I’m happy to be proven wrong.
- Raidion 2y agoI work for a company managing a team that has built this for GDPR compliance. Customer submits a deletion request. We have a fan out process that takes the deletion request and submits it to a bunch of different data locations. All of these must respond within 2 days (though the required time is 72h). Each of those data locations will queue up a job to remove access (soft delete) the data, and schedule a hard delete for 28 days in the future. If the customer says they don't actually want the data to be deleted, we cancel the data hard deletion and revert the soft delete. If nothing happens the hard deletion goes through.
- anyfoo 2y agoThanks, that’s insightful. In this case, it seems sensible to me at least.