[Jimw338]

> Is your customer data on a server that automation can tamper with? If so, is a copy periodically written to a write-only destination?

Wait, so now we should have customer data in more locations?! I'm not disagreeing at all - except that that seems directly contrary to the "intent" of the GDPR in the first place (though you could cynically say that the real intent of the GDPR was to raise money, employ bureaucrats, and shake down mainly-U.S. companies.

[LinuxBender]

It can be in the same country, just not the same pod/environment. It could even be a backup server with a vaulting policy that prevents backup admins from deleting things. i.e. require 2 C-levels to input something to delete anything.