Ask HN: How are you implementing GDPR-compliant soft deletes?

Re:Ask HN: How are you implementing GDPR-compliant soft dele... by tyfon on Tuesday February 13, 2018 @07:02AM (#16366470)

Yep, we've been through this discussion where I work just a few days ago and one way hashing even with salt is _not_ compliant as you can search for whatever you hashed and get a hit (SSNs, emails etc).

[ Parent | on HN ]

Re:Ask HN: How are you implementing GDPR-compliant soft dele... by otp124 on Tuesday February 13, 2018 @08:48AM (#16367046)

While GP stated soft-deletes aren't allowed, I figured I'd contribute to this thought exercise.

What about symmetric encrypting the field(s) and then giving the customer the key, and tell them to print it or store it safely, or else they won't be able to recover? And then don't store the key or write it to disk (remove it from memory)

[ Parent | on HN ]

Re:Ask HN: How are you implementing GDPR-compliant soft dele... by tyfon on Tuesday February 13, 2018 @09:12AM (#16367206)

Then you might as well scramble the data completely as the customer is not supposed to be able to recover the data after deletion.

[ Parent | on HN ]

Re:Ask HN: How are you implementing GDPR-compliant soft dele... by mailbag on Tuesday February 13, 2018 @11:24PM (#16373467)

We're going through a similar thought process now for a blockchain based data-store. If the data is symmetrically encrypted and the key is deleted.. does that count as hard deletion? The data is unrecoverable.

[ Parent | on HN ]