Re:GDPR for lazy people: Block all European users with Cloud...
by loup-vaillant on Friday May 25, 2018 @04:28PM
(#17157640)
Ah, OK. Makes more sense now. Still, requiring ISO compliance from a small business sounds like madness. An audit ought to be enough.
Re:GDPR for lazy people: Block all European users with Cloud...
by Kalium on Friday May 25, 2018 @04:33PM
(#17157686)
Again, makes total sense from the perspective of an American legal department. They're falling back on the tools they know to de-risk vendors, which is formal certifications and accreditations. ISO, SOC, etc. The lawyers are going to be extra twitchy because of how vague and hand-wave-y GDPR is.
An actual compliance audit from an accredited auditor, paid for by the SaaS offering of course, is not going to be cheap or easy.
Yes.
It's not unreasonable, because GDPR has components that require vendor assurance (more or less). So the megacorp with a point-of-presence in the EU has to be cautious about what strictly-US SaaS services it uses if there's any potential for data crossing into the SaaS.
This is almost certainly exactly what GDPR is intended to do. It aims, in part, to make sure companies can't shirk their responsibilities by handing everything over to vendors who will ignore GDPR.