[Silhouette]

I'm sorry, but this comment reads like something written by an academic with no real world experience of data protection issues and running businesses at all.

You should be able to provide this from a SQL query.

Please tell us all what that query should be, then, and how it's going to cover the relevant data stored in log files, emails, remote services used for payment processing, off-site backups, etc.

That's just a very minimal set of other places that almost any new online business is likely to be working with on day one.

Data Classification Plan

Asset Inventory Plan

Privacy Impact Analysis

Privacy Impact Assessment

Access Control Plan

Data Retention Plan

Data Collection Plan

Breach Escalation Plan

You're suggesting that in order to handle this kind of request -- which none of my businesses has ever received from anyone in many years of trading -- we should write up 8 different formal policies? These businesses probably don't have 8 different formal written policies in total at the moment. This is just totally detached from the realities of running small businesses, though it does reinforce my point about disproportionate burdens.

[The parent comment appears to have been edited after I wrote this. The terms above were in the original.]

[akshatpradhan]

>The parent comment

I wasn’t finished writing.

>we should write up 8 different formal policies?

Yes. That’s obvious.

[sanderjd]

You're making the parent's point. This is disproportionately burdensome to companies that don't have people dedicated to writing policies or lawyers dedicated to reviewing them.

[akshatpradhan]

Then refrain from collecting and processing data on individuals.

[Silhouette]

How is that a useful solution to anything? Almost any business will handle some form of personal data, and as such will have some degree of compliance overhead.

More overheads are generally bad for business. In the run up to Brexit, and given figures from the Chancellor's statement just this week showing relatively low productivity and growth in the UK economy, it's remarkable how many people don't seem to have a problem with increasing those overheads and thus negatively affecting the creation and growth of businesses.

There is a balance to be struck here. Protecting privacy is important, but not regulating in a way that introduces excessive burdens is also important.

[akshatpradhan]

If you want to collect and process data on individuals, then start implementing Security 101 basics:

* Data Classifications

* Privacy Impact Assessments

* Log Reviews

* Incident Reponse