This is a Canonical Question about interpreting the GDPR as discussed on meta.

While Server Fault may help you when you have a specific problem on implementing something related to the regulation, general questions about GDPR compliance are too broad, we are not lawyers who could interpret the legal issues, and Q/A style doesn't allow the in-depth discussion needed to know all the details in your organization to be sure that you actually comply.


I have a question regarding General Data Protection Regulation (GDPR), EU regulation 2016/679.

  • How to comply with GDPR?
  • Is my organization ready for GDPR?
  • Should I do X to comply with GDPR?
  • Does the GDPR forbid me from doing Y?
  • Is Z still allowed under the GDPR?
  • 3
    This sounds very good! – Sven Apr 18 at 20:59
  • I think this question wins the most broad and unanswerable question award – Timothy Frew Apr 28 at 23:34

As with most regulations, GDPR is not a clear list of rules on what to do and what not. Therefore, questions regarding it are often way too broad to handle on a Q/A site. There are many myths and incorrect simplifications around the regulation, and a whole industry is based on the fear of the sanctions imposed by the regulation.

This answer tries to give a practical overview of the subject. I'm not a lawyer, but I've been working around this subject nearly since it was introduced, first with an information gathering wait-and-see approach, and currently with another practical, sort of prioritizing and iterative approach.

We don't (yet) know how the regulation will be interpreted by the courts, and many companies are still waiting to see what actions others are taking. As Server Fault is for IT professionals, we are not lawyers who could interpret the regulation and its relation with other laws. Even if we could, Q/A style questions would be very long to have all the detailed information needed to answer: GDPR compliance is not a matter of individual actions, but an entire strategy inside your company. If you need to ask such questions, you may need to hire a consultant or even a lawyer. Many will, however, survive without one.

You have to create (possibly with some legal advice) your own strategy and, based on that, decide what actions you are performing to comply with GDPR. When you are trying to implement those changes in an actual information system, you may encounter technical problems on how something should be achieved. That's when the question has been narrowed down to the scope of Server Fault!


To get started you should know what the regulation is for. It's basically a legal framework for ensuring that personal data is handled carefully during its whole lifetime, from collection to deletion. GDPR Article 5 describes the principles for processing personal data, in short:

  • lawfulness, fairness and transparency
  • purpose limitation
  • data minimisation
  • accuracy
  • storage limitation
  • integrity and confidentiality.

GDPR gives data subjects i.e. citizens control over their personal data, and tools to make sure these principles have been respected. Those include the rights to access one's own data, to correct and move it, and to erase it i.e. the right to be forgotten (if no other law requires its preservation). It also gives the possibility of sanctions, and your company might need to designate a data protection officer.

Most of the the principles have already been implemented in national law (due to the Data Protection Directive 95/46/EC), which makes the change quite limited for companies inside the EU. Companies outside the EU may have a bit more to do if they process the personal data of EU citizens.

One main thing that changes is accountability, which is best achieved in practice by documenting your procedures thoroughly:

  • how and why the personal data is collected
  • what makes the processing lawful (consent being just one condition from Art. 6)
  • how the data is stored and processed
  • who has access to the data and how you control and audit this
  • whether it is removed (automatically / standard practice) when the reason for storage expires
  • how you handle the risks involved i.e. risk analysis.

In my opinion, if you've been carefully thinking about these things, fixed the problems and mitigated the risks you've discovered, and then documented all this, you should be far away from sanctions – even if you do suffer an intrusion. There will be an ocean of possible negligent behaviour between your situation and the kind of behaviour that makes one liable for €20 million / 4% of turnover fines.

  • That should be either As with or Like. – TRiG Apr 26 at 11:27
  • 1
    This is such a good answer I did a bit of fixing up on the English; I hope that's OK, Esa. – MadHatter Apr 28 at 15:53
  • @MadHatter: Thanks! Despite not totally hopeless, I'm still not a native speaker. :) – Esa Jokinen Apr 28 at 15:57

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.