Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [gdpr]

For questions regarding the implementation of and impacts on design and operations in light of the EU General Data Protection Regulation.

1
vote
1answer
44 views

Is a company decrypting all SSL traffic through a Root CA GDPR compliant? [on hold]

I am wondering if a company employing EU citizens is allowed to decrypt SSL traffic of those citizens in a MITM style attack without even informing them what data is collected (without even notifying ...
2
votes
1answer
1k views

EU GDPR - Data protection requirement standards missing?

I'm reading about the GDPR here and there. However, I see no requirements on how data actually is to be protected like Mimimum password length requirements Second factor authentication Backup ...
2
votes
1answer
57 views

Receiving Junk Email that is related to Skype conversations

My Microsoft email address and account are linked to Skype, OneDrive and Windows 10 (products I use by Microsoft). This account is not linked to my phone (Android). I don't use this account for Email (...
0
votes
1answer
38 views

GDPR data minimisation session cookies

I have a research study being run. Participants are asked to; Fill out a consent form (contains personal information as per GDPR) Complete a questionnaire. My hopes was that the questionnaire ...
0
votes
0answers
50 views

What is Amazon's GDPR role with Alexa for Business Conferencing?

With respect to GDPR and the Alexa for Business conferencing solution, is Amazon acting in the capacity of a data controller or a data processor, or even a sub-processor? Here's some information on ...
0
votes
1answer
42 views

does mailto require opt-out when user sending initial request for information from website? [closed]

Everything I have been reading on mailto: requirements has been that the company sending the email or using a website form submitting information. My situation is: on the company website, a lot of ...
28
votes
4answers
9k views

Is displaying email addresses in an application log file allowed under GDPR?

I'm working on an application that is completely built upon user interaction. In my application logs, I log each interaction and print the email address to uniquely identify which user did which ...
12
votes
3answers
3k views

How to handle emails as usernames under GDPR?

Using emails as usernames for webapps is a convenient way to avoid the "yet another online username" problem. As such, by using this approach, the emails should be easily available in the backend to ...
21
votes
2answers
5k views

Hashing email addresses for GDPR compliance

UPDATED We have a very unique scenario: We have several old databases of user accounts. We'd like a new system to be able to connect these old accounts to new accounts on the new system, if the user ...
1
vote
1answer
172 views

Steps to make website GDPR Compliant

I am working for a high traffic website developed in codeigniter. Can someone please help how to start working to make website GDPR compliant? Till now, I was able to identify the potential cookies ...
0
votes
2answers
118 views

GDPR - Personal Data breaches for invoices

A short question and scenario. Company X receives by mistake invoice of Company Y ( there is no relation between them ). Company X is reporting the case to Controller : - invoice is not mine , ...
1
vote
0answers
211 views

GDPR compliance in Amazon AWS

Anybody has a nice checklist/todo list to achieve GDPR compliance in Amazon AWS environments? Want to use dev-sec.io checklists, OWASP for web app, AWS Trusted Advisor. Anything else to include/...
1
vote
6answers
1k views

I am receiving weird emails regarding GDPR from electronicprivacy.eu

Since a week, I am getting some French emails. Since I don't know French I used google translate to know what is this about: Email 1: Bonjour, En application de mon droits d’accès et d’...
0
votes
2answers
195 views

Do websites outside of the EU need to consider GDPR? [closed]

There are a lot of items in the GDPR that I am a fan of. Mandatory unsubscribe links are the best thing to happen to my inbox since I started using email. But there is one thing in particular I've ...
1
vote
0answers
39 views

Method or tool to securely exchange sensitive data [closed]

Does anyone of you know tools or services that can help to securely exchange (personal or sensitive) data between two parties? After some requirements analysis, the tool or service should (among ...
1
vote
0answers
35 views

Do S3/Azure/GCS bucket names/keys represent personally identifiable information

We have an event-sourced system that uses a forward-only immutable event store. If we store personally identifiable information in this store, we'll be in trouble with regards to GDPR, as deletion ...
10
votes
1answer
574 views

GDPR Deletion Request Tracking Paradox - Suppression Lists

I work at a large-ish tech company with hundreds of websites and some large web applications with a very large number of users. I am planning to propose that we have a central system to track ...
0
votes
2answers
84 views

Does the advent of GDPR result in improved protections for customers based exclusively in non-EU countries?

Sorry if the title is a bit confusing. I'll try to rephrase: GDPR obviously improves transparency and protective services in global service providers/vendors that involve users in the EU. I can see ...
101
votes
7answers
21k views

Why do some GDPR emails require me to opt-out and some to opt-in? [closed]

I've noticed a trend in emails I've recieved as a result of GDPR, some of them are sort of 'opt-out' (or pseudo-opt-out where you just need to stop using their service) like so: Our updated Privacy ...
1
vote
0answers
108 views

Do I need to remove all past customers email adresses from newsletter subscription, if I haven't asked them consent before May 25 (GDPR)? [closed]

I receive many emails those days: If you haven't given your consent before 2018 May 25 to stay subscribed to our newsletter, we will be forced to remove your email from subscription, in accordance ...
0
votes
1answer
82 views

Tokenization - Is it bad practice to reuse tokens?

If I am implementing a tokenization system for PII within a database, is it considered bad practice, or riskier, to reuse tokens? For example, if I am storing the name "Richard" multiple times, and ...
19
votes
2answers
8k views

Is gender considered PII (Personally Identifiable Information) under the GDPR?

Since GDPR is shaking everything up at the minute I'm working on a few changes to our website/process. I work in eCommerce in UX (UK based) and support marketing teams with certain activities. My ...
1
vote
1answer
345 views

Microsoft Exchange: Email and attachment encrypting

As per recent updates in UK data protection legislation I have been trying to find ways of encrypting all outbound emails from my server and was considering moving all our emails from a basic email ...
-1
votes
1answer
315 views

What does pseudonymization mean in the context of web development?

In readiness for the new GDPR legislation that is coming in on May 25th, I am trying to understand what pseudonymization means in the context of web development. The info I've read infers that it is ...
0
votes
1answer
118 views

GDPR data portability [closed]

I know one of the requirements of the GDPR is for data portability requests. On a website I have, it has users that includes their address, contact number etc but it also tracks what the user ...
6
votes
3answers
325 views

If I'm PCI-DSS compliant, do I need to worry about GDPR?

Next month, the EU's General Data Protection Regulation (GDPR) takes effect. Our organization is already PCI-DSS compliant. Do we need to do anything additional to make sure we are consistent with ...
3
votes
1answer
146 views

Does GDPR apply to generic service providers?

Let's say you have a general Cloud service to create PDFs from content or even a data storage. Neither services are meant to process PII data (in the sense of GDPR), still - as the content is not ...
3
votes
1answer
2k views

Does it make sense to encrypt database to comply with GDPR?

I had a hard time phrasing the question. I'd rather ask, "How do I comply with GDPR?" But that would probably be too broad of a question. Database encryption concerns me the most, since that's what ...
0
votes
0answers
91 views

Tracking user's private link on google analytics: will it be a security issue for GDPR?

Our web portal track page access with google analytics. The access link will be then tracked and exposed in google analytics reports. As the portal include personally identifiable information (PII), ...
2
votes
1answer
630 views

Caching personal data: GDPR

There are requests in my web application that contain "personal data" (name, postal code, phone number, date of birth etc). I would like to know what caching controls are advisable. I am using HTTPS. ...
3
votes
2answers
113 views

Should passwords and challenge questions & answers be migrated?

I am currently working on the migration of a user Identity and Access Management tool from a legacy platform (product + solution) to a new one (same product but upgraded + updated solution) My team ...
1
vote
2answers
1k views

What will the effect of the GDPR be on password dumps? [closed]

The GDPR changes a lot of data protection law, but how will it affect dumped databases of passwords? At the moment these can be used to work out the most common passwords, and sites can use this ...
0
votes
1answer
246 views

Under GDPR, is one user borrowing another's logged-in session for financial transactions illegal?

Our organization has historically been very lax with Data Protection and compliance, and we have a number of POS sales positions serving the public and taking payments; both Cash, Chip and Pin and ...