zlacker

It is highly unlikely that a lot of requests will "sink" your company. As per the GDPR, you have a month to respond to requests and you can extend this period by two more months by telling the user that you need more time to process their request. (See article 12 for reference)

>>cbg0+(OP)
If 10% of the members of my website request a GDPR, then my website will no longer exist. The processing time for that would be a decade.

>>Anabee+81
You mean request to be forgotten? Are you seriously lacking an automated removal process if you have more than a thousand users and also can't keep it in a three month deadline? Oor is it collecting so much data that you cannot just send it all to the requestee?

If it would take a decade, then it is a broken business that should cease to exist as it is doing something illegal with the collected data. What kind of business is it?

>>Anabee+81
If this is such a serious concern, you should automate this process as much as possible. You don't necessarily need to respond manually to these requests if you put in place the required features on your website which will allow your EU data subjects to benefit from their rights.

Realistically, how hard is it to automatically grab some data from a database and export it as JSON, as well as remove data from your database pertaining to a user? With a relational database, this would be a cinch. I mention the right to access the erasure right, as I estimate these will be the most frequently called upon.

>>Anabee+81
If you have a lot of “members” you obviously provide the services by the automated process. Obviously the request processing could also be mostly automatic.

>>Anabee+81
Then automate it. If you can't automate it within one month plus two months extension, you have bigger problems than GDPR requests.

>>Anabee+81
What does it mean to "request a GDPR"?

>>Anabee+81
As said below, this can be automated. If you can't or won't comply, then your website shouldn't exist.

>>cbg0+43
Depends on your system. We have an automated process that produces a PDF, which a human will then go through and redact so we're not leaking through the non-relevent PII of other people if one of our users isnt using the system quite properly.

>>Sanger+cG
Or we just avoid the EU altogether.

It shouldn’t even be possible to request anyway.