Hot answers tagged

109 votes
Accepted

Why do some GDPR emails require me to opt-out and some to opt-in?

It is not clear that the first kind of email is legal. A French association, la Quadrature du Net, is planning to launch a class action against five big tech companies (the famous "GAFAM") on May 28th ...
N.I.'s user avatar
  • 992
44 votes
Accepted

Is displaying email addresses in an application log file allowed under GDPR?

The goal of GDPR is about protecting personally identifiable information (PII) as much as possible. The interaction of a specific user with your application are pretty sure such PII. If you really ...
Steffen Ullrich's user avatar
39 votes
Accepted

Hashing email addresses for GDPR compliance

MD5 or SHA is not the concern. Hashes can be used for pseudonymization. The problem is that the hash would need to be salted (or peppered) so that data from other sources could not be used to identify ...
schroeder's user avatar
  • 129k
32 votes

Is displaying email addresses in an application log file allowed under GDPR?

Logging data is not the issue under GDPR. The part that matters is what happens to the log, who can see it, how long it is stored, what the log is used for, and if you can satisfy the rights of the ...
schroeder's user avatar
  • 129k
22 votes
Accepted

Is gender considered PII (Personally Identifiable Information) under the GDPR?

The definition of personal data as mentioned in the GDPR: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural ...
Stef Heylen's user avatar
  • 1,736
19 votes

Why do some GDPR emails require me to opt-out and some to opt-in?

Some quotes from the GDPR law: [...] Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to ...
reed's user avatar
  • 15.8k
12 votes
Accepted

How to handle emails as usernames under GDPR?

IANAL, but GDPR does not make encryption mandatory for personal data. Read this article to understand the complexity around encryption and GDPR better. In the GDPR encryption is explicitly ...
Niels van Reijmersdal's user avatar
11 votes

Why do some GDPR emails require me to opt-out and some to opt-in?

The 1st category are the big companies (like large e-mail providers) that will do what they want anyway and since you want to use their service you will have accept their conditions. Not doing that ...
Overmind's user avatar
  • 8,899
10 votes

Why do some GDPR emails require me to opt-out and some to opt-in?

Firstly, there's no case law yet, and different lawyers are interpreting the rules in different ways: some are playing very safe, others are sailing closer to the wind. Some probably reckon that they ...
Michael Kay's user avatar
9 votes
Accepted

If I'm PCI-DSS compliant, do I need to worry about GDPR?

Assuming GDPR apply to your organization, yes you should worry about GDPR. PCI-DSS compliance doesn't imply GDPR compliance. There are many concept present in GDPR and not in PCI-DSS or not with the ...
Whysmerhill's user avatar
9 votes
Accepted

Does it make sense to encrypt database to comply with GDPR?

On Compliance I'm only loosely familiar with the specifics of the legislation, but as I understand it, there's nothing to indicate that database encryption is required to hold personal information ...
nbering's user avatar
  • 4,028
8 votes

Is gender considered PII (Personally Identifiable Information) under the GDPR?

TLDR: Possible From https://www.seobyrvc.com/what-is-personally-identifiable-information-pii/: The following are examples of “potentially personally-identifiable information”. That is, the data ...
toom's user avatar
  • 584
8 votes

Is displaying email addresses in an application log file allowed under GDPR?

Article 5 of GDPR specified the basic principles for processing data. Article 5 "Principles relating to processing of personal data" (1) Personal data shall be: ... (b) collected for ...
Pete's user avatar
  • 181
6 votes

Why do some GDPR emails require me to opt-out and some to opt-in?

As other answers have stated, GDPR requires explicit, informed, unambiguous consent. Plus, according to the accountability principle, data controllers shall be able to demonstrate that. In theory: ...
ysmartin's user avatar
  • 161
6 votes
Accepted

EU GDPR - Data protection requirement standards missing?

In the GDPR regulation (Article 39, on page 7), it says Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, ...
Alex Probert's user avatar
5 votes

Caching personal data: GDPR

The law is about what you are allowed to store and targets your infrastructure. And the law is intended to give the user control over his data. The client cache belongs to the client's infrastructure ...
allo's user avatar
  • 3,382
5 votes

Does GDPR apply to generic service providers?

Technically, the Data Controller is responsible for making sure all processes are GDPR compliant. That means that whoever uses your service needs to make sure that they are being compliant. If they ...
schroeder's user avatar
  • 129k
5 votes

Why do some GDPR emails require me to opt-out and some to opt-in?

On top of the areas already mentioned here, there's a section of GDPR relating to data retention. A lot of the e-mails which are asking people (or at least the ones I am getting) to opt in are also ...
gabe3886's user avatar
  • 384
5 votes
Accepted

Steps to make website GDPR Compliant

There is no binary answer to be 'GDPR compliant'. There are however some steps you can take to be compliant to some extend. Key element to the GDPR is that you need either explicit permission from ...
Kevin's user avatar
  • 1,653
5 votes
Accepted

Anonymizing IP addresses using (sha) hashes; how to circumvent rainbow table attacks?

From a pure security standpoint, I see 3 possible improvements to your system: Using a slow hash like bcrypt. It is serveral order of magnitude slower than SHA-1. Your application won't be impacted, ...
Benoit Esnard's user avatar
5 votes

Does GDPR apply for volatile data

The GDPR isn't just about storing sensitive data, but it's more general. In fact, it's actually about processing personal data. Here are a few interesting quotes from the GDPR that you might want to ...
reed's user avatar
  • 15.8k
4 votes
Accepted

Tokenization - Is it bad practice to reuse tokens?

Yes, it introduces risk, but might be required, depending on what you're doing with the data. Imagine a database of lots of people. Perhaps it includes names, addresses, and dates of birth, but the ...
Matthew's user avatar
  • 27.4k
4 votes
Accepted

GDPR Deletion Request Tracking Paradox - Suppression Lists

It is exactly the right thing to have a deletion request management system. In fact, given the importance of this function, the timeframes for response, the workflows to coordinate, it is almost ...
Jonah Benton's user avatar
  • 3,497
4 votes

Hashing email addresses for GDPR compliance

Realistically, pseudonymization is any method of obfuscating someone's PII/NPI so that it can't be reasonably traced back to one certain individual. GDPR doesn't necessarily dictate what hashing ...
GhostInTheShell's user avatar
4 votes
Accepted

Documentation for GDPR best practices for partially masking email addresses

There is no official guidance because this is not a GDPR enforced requirement. GDPR does not regulate specific security measures beyond making recommendations about what you should consider. Since you ...
Overmind's user avatar
  • 8,899
3 votes

If I'm PCI-DSS compliant, do I need to worry about GDPR?

If you are selling goods or services to EU residents, then yes. GDPR regulation is different from PCI-DSS. Even if you are compliant with PCI-DSS, that doesn't mean you are compliant with GPPR. ...
Script_Junkie's user avatar
3 votes

Is a company decrypting all SSL traffic through a Root CA GDPR compliant?

The problem with the GDPR lies in the remark: "without even notifying this software is being installed". In that case: no it is not compliant. If you dig a little deeper, you will find that in almost ...
Ljm Dullaart's user avatar
  • 2,105
3 votes

Documentation for GDPR best practices for partially masking email addresses

GDPR is more restrictive than the US definition of PII, in which, non-PII that allow any inference to the identities is also under GDPR jurisdiction. I doubt given masking examples will withstand ...
mootmoot's user avatar
  • 2,407
3 votes

Anonymizing IP addresses using (sha) hashes; how to circumvent rainbow table attacks?

As long as you are not storing IP addresses alongside other personally identifiable information, they do not have to be handled under GDPR rules. They only become sensitive when enriched with a user's ...
James's user avatar
  • 49
3 votes

Anonymizing IP addresses using (sha) hashes; how to circumvent rainbow table attacks?

GDPR requires reasonable protection of such data but does not totally forbid storing these data. Since the hashes are only stored on the server (where the attacker should have no access anyway and ...
Steffen Ullrich's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible