5

The GDPR isn't just about storing sensitive data, but it's more general. In fact, it's actually about processing personal data. Here are a few interesting quotes from the GDPR that you might want to consider (emphasis added): Article 2(1) - This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing ...


3

I‘m especially concerned if someone was able to get access to backend code and therefore acquire the SQL credentials. The database system should be accessible from a limited number of systems. Specifically, it should not be accessible from the internet. If someone has the SQL credentials, they still won't have access to the server. Common sources of leaks ...


2

Although, I couldn't find any information on how (or if even) GDPR applies for sensitive data in a volatile state GDPR indicates to protect data in storage, processing and in transit. The data in the volatile memory is(in most cases)/shall only be accessible to trusted process/ child or parent process or processes. Basically make sure process can not be ...


2

Short answer: GDPR does not strictly require you to use encryption. Long answer: There are no guidelines on how to see encryption in the scope of the GDPR, which really is a pity given existing confusions. However, there are some guidelines mentioning encryption. But guidelines are not something mandatory. Although the GDPR obviously requires that ...


Only top voted, non community-wiki answers of a minimum length are eligible