I’m not confident in anything I’ve written ever to have it picked apart by a team of expert witness programmers. Maybe that means I have no business working at a startup. Maybe we should think about the implications of that.
Then you shouldn't be handling PII, any more than you should be handling credit card details, genetic information or military intelligence.
>Maybe that means I have no business working at a startup. Maybe we should think about the implications of that.
The EU has, and has decided that having seen the alternative, it would rather just not have the startups. I think that's a reasonable position to take.
A good thing because it means startups stop playing fast and loose with my data. These are just growing pains. In a few years, enough stuff will be written online about best practices to stay GDPR compliant. The new guys can follow that.