„In a small company, investing in security is a waste of money."
Are you sure about that?
Article 11 GDPR
Processing not requiring identification
P: 57
1. If the purposes for which the controller processes personal data do not require or no longer require the controller to identify the data subject, the controller is not required to retain, obtain or process additional information to identify the data subject solely to comply with this Regulation.
2. If, in the cases referred to in paragraph 1 of this Article, the controller can demonstrate that it is unable to identify the data subject, it shall, where possible, inform the data subject of this fact. In such cases, Articles 15 through 20 shall not apply, unless the data subject, in order to exercise the rights granted to him or her under those articles, provides additional information enabling his or her identification.
