News for hackers. Stuff that matters.

A comment on Apache Kafka and GDPR compliance. Parent comment

Re:Apache Kafka and GDPR compliance by sulam on Monday December 04, 2017 @06:15PM (#15848469)
I believe your understanding is incorrect. GDPR certainly includes storage and processing, both of which backups probably trigger.

Anyway, think about the spirit of the law, and then think about how that interacts with backups. If someone asks to be deleted from your system, you do so, and then you restore a backup with their data, you have clearly violated the intent.

[ Parent | on HN ]
Re:Apache Kafka and GDPR compliance by tscs37 on Tuesday December 05, 2017 @12:28AM (#15849941)
Keep a log of deleted users and re-delete upon restore.

The GDPR contains exceptions for data storage for which it is infeasible or outside reasonable effort to delete individual records or you have legal compliances to uphold.

[ Parent | on HN ]
Re:Apache Kafka and GDPR compliance by jgeraert on Tuesday December 05, 2017 @03:30AM (#15850562)
Isn't the log of deleted users subject to the GDPR then?
[ Parent | on HN ]
Re:Apache Kafka and GDPR compliance by hobofan on Tuesday December 05, 2017 @04:09AM (#15850690)
You can make a log of deleted users without it containing personally identifiable information, by just storing the IDs.
[ Parent | on HN ]
Re:Apache Kafka and GDPR compliance by zaarn on Tuesday December 05, 2017 @04:07AM (#15850682)
No since the GDPR exempts things you need for legal compliance, thus a list of users who have asked to be deleted is fine if it's being used to ensure compliance.
[ Parent | on HN ]