Hacker News Reader

Oh but GDPR is more than "don't do marketing". There´s stuff like "Right to be forgotten" that implementing controls for it would require a company starting from scratch to spend resources in "getting it right", and then you have things like backups, that may or may not fall in scope. And this is only one of the 8 rights that the GDPR provides.

View on HN

First of all, it's not "don't do marketing", it's don't do "user-tracking-and-profiling based advertising". Marketing is so much more, like actual market research to provide a service users actually want.

You have to handle a "right to be forgotten" query within a month, surely this is enough time for one sysop to run a prepared query. If your database is so byzantine that you cant find all reference to a given customer, you are either google or in need of a new architect.

Backups do not need to be deleted immediately, they should however expires and be destroyed in accordance to your data retention policy (Say what you do, do as you say).

Reply on news.ycombinator.com