How does GDPR affect your business? You're not really responsible for anybody's data, presumably you inherit the policies of your customers.

First, I'm responsible for handling my clients' data, such as their email addresses or phone numbers. It doesn't matter that they're business customers rather than consumers. GDPR still applies.

Secondly, though not always the case, I might have to process their respective customers' data in some way in order to do my job (by having access to a production database, for example).

So, yes, GDPR absolutely does apply to my business.

So you're saying that you are asking consent to store the phone number and email address of a client? And you'll provide clients with the right to be forgotten, meaning that you're prepared to delete their contact information? This seems like overkill.

> So you're saying that you are asking consent to store the phone number and email address of a client?

No, I didn't say that. GDPR doesn't mean that you have to ask for consent in each and every case. If as a business you have a legitimate interest to store client data for a specific purpose you don't have to ask for explicit consent. Being able to contact clients in the future who contacted you first constitutes such a legitimate interest.

As for the right to be forgotten: Sure, why wouldn't I? If they don't want to be contacted anymore and want me to delete their contact info I'm happy to oblige.

Past invoices will have names and addresses, will you shred them? Don't you need them to file taxes?

Existing laws and accounting standards still take precedence over GDPR. Past invoices and accounting entries remain as they are.

Can you please share how GDPR affects the second workflow? I'm curious, as I've performed similar work.

It means that in that case I have to provide my client with a data processing agreement and handle data accordingly.

Basically, it means that what's been best practice all along is made explicit. So, in most case this doesn't affect the actual workflow all that much.

However, in the past occasionally clients could be quite liberal in handing out access to their production data. GDPR definitely has raised awareness that this isn't something to be taken lightly.