Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [gdpr]

For questions regarding the implementation of and impacts on design and operations in light of the EU General Data Protection Regulation.

2
votes
0answers
57 views

How to store the username in database under GDPR? [migrated]

This is not a duplicate of How to handle emails as usernames under GDPR? because my question is related with performance. I have an application that I want to make comply with GDPR. My strategy for ...
1
vote
6answers
936 views

I am receiving weird emails regarding GDPR from electronicprivacy.eu

Since a week, I am getting some French emails. Since I don't know French I used google translate to know what is this about: Email 1: Bonjour, En application de mon droits d’accès et d’...
0
votes
0answers
20 views

Query encrypted database data with .NET Core and MS SQL Server

In a .NET Core application, we are storing chat conversations in the database. Currently we encrypt data using AES encryption. Things work out fine when storing and reading single values, but now we ...
0
votes
2answers
180 views

Do websites outside of the EU need to consider GDPR? [closed]

There are a lot of items in the GDPR that I am a fan of. Mandatory unsubscribe links are the best thing to happen to my inbox since I started using email. But there is one thing in particular I've ...
1
vote
0answers
33 views

Method or tool to securely exchange sensitive data [closed]

Does anyone of you know tools or services that can help to securely exchange (personal or sensitive) data between two parties? After some requirements analysis, the tool or service should (among ...
1
vote
0answers
30 views

Do S3/Azure/GCS bucket names/keys represent personally identifiable information

We have an event-sourced system that uses a forward-only immutable event store. If we store personally identifiable information in this store, we'll be in trouble with regards to GDPR, as deletion ...
0
votes
2answers
67 views

Does the advent of GDPR result in improved protections for customers based exclusively in non-EU countries?

Sorry if the title is a bit confusing. I'll try to rephrase: GDPR obviously improves transparency and protective services in global service providers/vendors that involve users in the EU. I can see ...
1
vote
0answers
84 views

Do I need to remove all past customers email adresses from newsletter subscription, if I haven't asked them consent before May 25 (GDPR)? [closed]

I receive many emails those days: If you haven't given your consent before 2018 May 25 to stay subscribed to our newsletter, we will be forced to remove your email from subscription, in accordance ...
100
votes
7answers
20k views

Why do some GDPR emails require me to opt-out and some to opt-in? [closed]

I've noticed a trend in emails I've recieved as a result of GDPR, some of them are sort of 'opt-out' (or pseudo-opt-out where you just need to stop using their service) like so: Our updated Privacy ...
0
votes
1answer
71 views

Tokenization - Is it bad practice to reuse tokens?

If I am implementing a tokenization system for PII within a database, is it considered bad practice, or riskier, to reuse tokens? For example, if I am storing the name "Richard" multiple times, and ...
19
votes
2answers
6k views

Is gender considered PII (Personally Identifiable Information) under the GDPR?

Since GDPR is shaking everything up at the minute I'm working on a few changes to our website/process. I work in eCommerce in UX (UK based) and support marketing teams with certain activities. My ...
1
vote
1answer
175 views

Microsoft Exchange: Email and attachment encrypting

As per recent updates in UK data protection legislation I have been trying to find ways of encrypting all outbound emails from my server and was considering moving all our emails from a basic email ...
-1
votes
1answer
266 views

What does pseudonymization mean in the context of web development?

In readiness for the new GDPR legislation that is coming in on May 25th, I am trying to understand what pseudonymization means in the context of web development. The info I've read infers that it is ...
1
vote
0answers
136 views

GDPR compliance in Amazon AWS

Anybody has a nice checklist/todo list to achieve GDPR compliance in Amazon AWS environments? Want to use dev-sec.io checklists, OWASP for web app, AWS Trusted Advisor. Anything else to include/...
2
votes
1answer
779 views

EU GDPR - Data protection requirement standards missing?

I'm reading about the GDPR here and there. However, I see no requirements on how data actually is to be protected like Mimimum Password lenght requirements Second factor authentication Backup ...
0
votes
1answer
101 views

GDPR data portability [closed]

I know one of the requirements of the GDPR is for data portability requests. On a website I have, it has users that includes their address, contact number etc but it also tracks what the user ...
10
votes
1answer
1k views

How to handle emails as usernames under GDPR?

Using emails as usernames for webapps is a convenient way to avoid the "yet another online username" problem. As such, by using this approach, the emails should be easily available in the backend to ...
3
votes
1answer
129 views

Does GDPR apply to generic service providers?

Let's say you have a general Cloud service to create PDFs from content or even a data storage. Neither services are meant to process PII data (in the sense of GDPR), still - as the content is not ...
10
votes
1answer
473 views

GDPR Deletion Request Tracking Paradox - Suppression Lists

I work at a large-ish tech company with hundreds of websites and some large web applications with a very large number of users. I am planning to propose that we have a central system to track ...
6
votes
3answers
301 views

If I'm PCI-DSS compliant, do I need to worry about GDPR?

Next month, the EU's General Data Protection Regulation (GDPR) takes effect. Our organization is already PCI-DSS compliant. Do we need to do anything additional to make sure we are consistent with ...
3
votes
1answer
1k views

Does it make sense to encrypt database to comply with GDPR?

I had a hard time phrasing the question. I'd rather ask, "How do I comply with GDPR?" But that would probably be too broad of a question. Database encryption concerns me the most, since that's what ...
0
votes
0answers
83 views

Tracking user's private link on google analytics: will it be a security issue for GDPR?

Our web portal track page access with google analytics. The access link will be then tracked and exposed in google analytics reports. As the portal include personally identifiable information (PII), ...
2
votes
1answer
513 views

Caching personal data: GDPR

There are requests in my web application that contain "personal data" (name, postal code, phone number, date of birth etc). I would like to know what caching controls are advisable. I am using HTTPS. ...
3
votes
2answers
105 views

Should passwords and challenge questions & answers be migrated?

I am currently working on the migration of a user Identity and Access Management tool from a legacy platform (product + solution) to a new one (same product but upgraded + updated solution) My team ...
1
vote
2answers
832 views

What will the effect of the GDPR be on password dumps? [closed]

The GDPR changes a lot of data protection law, but how will it affect dumped databases of passwords? At the moment these can be used to work out the most common passwords, and sites can use this ...
0
votes
1answer
216 views

Under GDPR, is one user borrowing another's logged-in session for financial transactions illegal?

Our organization has historically been very lax with Data Protection and compliance, and we have a number of POS sales positions serving the public and taking payments; both Cash, Chip and Pin and ...