The two things that needed to be developed were systems around rights of erasure & access. Both of these are pretty straight-forward systems -- it's a REST API for getting user details from a system, and deleting user details from the system.
I believe people are making GDPR out to be a much worse than it is.
What are you considering 'user details' ?
If you have a database with users in it, that's basically the row in the Users table, along with everything in the database that has a user_id, which depending on the data you're talking about, might be enough to just set the user_id to `null`, but if unsure and if possible, then cascade delete is the safe choice.
Basically that's nothing that a normal RDBMS doesn't do efficiently already. If you are using a RDBMS, you should have had a sane deletion policy on your foreign keys already.
It gets more complicated with NoSQL databases of course, but you knew already that by using a NoSQL that's essentially technical debt you're postponing. But having worked on many such systems in the past, it's not a tragedy and certainly not something that couldn't be solved in the last 2 years since the GDPR was adopted.
Honestly, GDPR was adopted 2 years ago and people now act all surprised that it came into effect.
thank you for your response. I've been trying to find this in GDPR docs but i can't seem to find a clear definition. Can you link me to the definition if you have it handy by any chance.
I can tell you couple of examples where simple delete from database is not enough.
One example is a analytics pdf report that was sent to management with geo diagram with number of purchases dotsizes/zipcode in a city.
My understanding, from a friend there, is GDPR imposes significant costs on their operations. The problem isn’t the intent of the law. It’s its implementation. The administrative burdens imposed by the mandated bureaucracy is massive.