Today is the day. GDPR is in effect. After six months of intensive preparation, we’re sharing what we managed to implement, what we’re still fighting with, and what we learned.
What Works¶
Encryption at rest and in transit — 100% complete. Consent management — new system with granular consents. Data export — API endpoint for personal data export in JSON. Audit logging — centralized audit trail, immutable storage.
What We Didn’t Finish 100%¶
Right to erasure in backups. We’re solving this with crypto-shredding — data encrypted with per-tenant keys, deleting the key effectively destroys the data.
Third parties. We have DPAs signed, but technical integration for propagating erasure requests isn’t complete.
What We Learned¶
- Data mapping is 10x more work than you expect
- Cross-team coordination is critical
- Privacy by design should be standard from the beginning
- Documentation is key — DPO needs clear evidence
GDPR is a Marathon, Not a Sprint¶
We didn’t finish everything 100%. But we have a solid foundation, a clear plan, and — most importantly — a cultural shift in the team. Privacy is now part of every design decision.
Brauchen Sie Hilfe bei der Implementierung?
Unsere Experten helfen Ihnen bei Design, Implementierung und Betrieb. Von der Architektur bis zur Produktion.
Kontaktieren Sie uns