1

Not sure if that's right site to ask about technical Database things but if I've a table that contains the following fields :

client_id
name
first_name

and that I want to be GPDR Complient does I need to add the following fields ?

client_id
name
name_date_created
name_date_updated
first_name
first_name_date_created
first_name_date_updated

Or I can just have ?

client_id
name
first_name
date_created
date_updated
  • 1
    Could you explain why you think that these date fields might help with GDPR compliance? – amon May 3 at 10:14
  • I'm maybe wrong, but I think that you must be able to retreive who modified some users data. That I must be able to track those data. – snoob dogg May 3 at 10:29
2

The GDPR does not directly require that changes to the data be tracked. However:

  • If data was not obtained from the data subject, you do have to know where the data came from (see Art 14(2)(f)).
  • The data controller must take appropriate security measures (see Art 24).
  • There might be a concrete purpose for which this change tracking is necessary.

If the analysis of the data controller establishes that it is necessary to track who modified the records when, then you would have to implement an appropriate database schema or logging system.

For example, an online video streaming service would probably not have to track changes to the user profile name. But they might find that they need to track changes to billing information for the purpose of fraud prevention (a business purpose outside of the GDPR) or to protect the information against unauthorized changes (a safety measure within the GDPR).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.