Two fucking years, to be precise, considering it was adopted on 14th April 2016 with the two year transition period and yet it seems some businesses only started to care on 1st May 2018. :D
To be fair there is more than a few vague items in the regulation that make it difficult to implement for some businesses. For example it's unclear how disaster recovery can effectively be used to restore systems without breaking the law or how long logs can be archived without violating "without undue delay".
Even today as the law goes into effect, it's still unclear how processors outside the EEA are supposed to act. A client and their team of lawyers has been trying hash that out for a couple months now.
Two fucking years, to be precise, considering it was adopted on 14th April 2016 with the two year transition period and yet it seems some businesses only started to care on 1st May 2018. :D
To be fair there is more than a few vague items in the regulation that make it difficult to implement for some businesses. For example it's unclear how disaster recovery can effectively be used to restore systems without breaking the law or how long logs can be archived without violating "without undue delay".
Even today as the law goes into effect, it's still unclear how processors outside the EEA are supposed to act. A client and their team of lawyers has been trying hash that out for a couple months now.
Yeah, some issues are really practical, I guess we'll know when the first lawsuits will start :(