I keep telling people - the thing that changes with GDPR is that personal data you handle is now still owned by the person and only in your custody as long as they explicitly allow it.
That person doesn't own those bits on that hard drive.
That person doesn't own those bits on that hard drive.
How you decide to store it makes little difference as long as it's digital.
Fun aside: if you store it on paper you're not beholden to GDPR. Crazy.
Think about. A person doesn't own the random bits (data) about them that goes through and is stored on various systems they interact with. Under the GDPR in the EU, they might have a right to know what is stored about them on various systems, but they don't "own" that data.
That's impossible and doesn't make sense.
Do you have a source for this?
From some quick googling that doesn't appear to be true.
https://www.orsgroup.com/news/compliance/how-the-gdpr-affect... https://www.winterhawkconsulting.com/4946-2/ https://www.p4p.uk.com/gdpr-compliance-paper-documents/