GDPR and date of fields creation / update

Question

Not sure if that's right site to ask about technical Database things but if I've a table that contains the following fields :

client_id
name
first_name

and that I want to be GPDR Complient does I need to add the following fields ?

client_id
name
name_date_created
name_date_updated
first_name
first_name_date_created
first_name_date_updated

Or I can just have ?

client_id
name
first_name
date_created
date_updated

Answer 1

The GDPR does not directly require that changes to the data be tracked. However:

• If data was not obtained from the data subject, you do have to know where the data came from (see Art 14(2)(f)).
• The data controller must take appropriate security measures (see Art 24).
• There might be a concrete purpose for which this change tracking is necessary.

If the analysis of the data controller establishes that it is necessary to track who modified the records when, then you would have to implement an appropriate database schema or logging system.

For example, an online video streaming service would probably not have to track changes to the user profile name. But they might find that they need to track changes to billing information for the purpose of fraud prevention (a business purpose outside of the GDPR) or to protect the information against unauthorized changes (a safety measure within the GDPR).