Quote Originally Posted by Ash View Post
Apart from the whole consent fandango, there's the infrastructure security too. If you get hacked, it's basically your fault unless you can show you have done everything possible to avoid it, which basically means bankrupting yourself hiring security consultants to do 'penetration tests' on your websites and networks. And if an external data processor you use can't produce compliancy documentation you're supposed to sack them off as if an alternative is available off the peg to just plug in instead. Who'd want to take DPO responsibility for that lot?
I keep hearing the words "...all reasonable steps" with regards to GDPR. The lawyers will have a ****ing field day with this one, of course.

I am sure it is me who will be expected to be the DPO

I am already pissed off at getting retrospective consent for stuff.

And getting express consent from employees' emergency contacts to have their details stored on our database is like pulling teeth