Comment by jiveturkey

so you say. if you don’t have strong processes to make sure that is true, it isn’t true. gdpr is mostly about ensuring you have such processes. if you can’t do things such as tell the user what data you have, and delete it, you do not have a great policy.

methinks you need some advice from better counsel. i bet that you are closer to compliant than you think.