tl;dr: TLS inspection is just another tool in your toolbox to control your corporate network traffic. While it might help to avert infections and detect exfiltration traffic, it's by no means required by GDPR.

The reasoning for this is mostly:

Malware can use TLS to load malicious payloads and exfiltrate data + Data loss and data breaches are targeted by GDPR => Decrypting the traffic let's you detect the malicious activity and prevent the infection / notice the exfiltration, which can help you staying GDPR compliant.

IANAL, but as long as it's a black box and the traffic doesn't get stored nor is accessible, the logs don't contain any personal information and the users are in the know about this processing, it should be okay.

7 common misunderstandings about SSL encryption: separating fact from fiction https://gdpr.report/news/2017/07/11/7-common-misunderstandin...

SSL Inspection is Imperative Under GDPR https://www.a10networks.com/blog/ssl-inspection-imperative-u...

Both articles are written by a company selling SSL inspection solutions...

Any assertion backed by data from the Ponemon Institute is by definition bullshit.

I apologize for not researching the topic properly. :(

Here is an update for discussion Spooky23!

GDPR Controversial Topics https://www.eugdpr.org/controversial-topics.html

There was a post asking about SSL necessity for GDPR and I didn't research the question properly.

If a website isn't payment orientated or doesn't hold sensitive information (Ex. email, credit cards, addresses, forum etc.) Why would you need to invest in SSL? Another?

How is the site coded? Ex. XHTML/HTML/CSS || Or CMS, PHP, JavaScript

Any feedback would greatly be appreciated!