MyAccountYo
* It's complicated so it takes a while and you need lawyers and such to make it right
* Rules for training are probably hugely vague and undefined. Because you could ingest personal data and it cannot be deleted
* AFAIK it needs to be hosted in Europe (not directly GDPR related, but america has laws that allows them to spy on all traffic in the US, so this is somewhat the counter to that)
In the end from my experience just working at a company that needs to be compliant this usually means:
* All the services need to be hosed in EU including 3rd parties we send any data to
* There needs to be a way (email is enough) to delete user data (including from 3rd parties which need an endpoint so you can trigger it from your side)
* You need to inform the user about the data useage and allow them to opt out of the "usage" of this data for non-essential things (i.e marketing emails). This does not mean you cannot save this data if you also use it for other things, but you can not use it for the non-essential case.
* You could be in trouble if you save data "just because" and do not use it for anything essential or if it is not transparent to the user.
Not a lawyer. Just the things I notice in my day to day. In the end companies need data protection professionals to navigate these things. Which is probably another thing a startup does not worry about it early on.
I have gone through the migration of monoliths to microservices (yes, at scale with multiple teams and requirements to scale individual components etc.) and it solved a lot of problems.
The benefits outweigh the costs in my opinion (and drastically so).
When people say "you can write well separated components in a monolith..." I can only say: of course you could, but you are not going to (and certainly not everybody at your giant ass company is going to).
I think what I want is this idea of "code completion" but not for writing the methods, which is the easy part. Instead the tool should structure classes and packages and modules and naming and suggest better ways to write certain things.
I am sure some lock down rules and some implementations of them were not good. But "live with it" was not the same back then as now.