Application logging in the era of GDPR
summary
Shows concrete rules: log only what is necessary and justify each field, classify fields into high/medium/low sensitivity, and keep examples (SSNs and health = high, IP/gps = medium, email/name = low). Requires a log retention policy tied to utility or contract, delete when expired, and avoid debug-level logging in production. Protect logs with access control, TLS in transit, and techniques like masking and tokenization or encryption rather than vague promises about “examples.”
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:19Disclaimer
- 2:06Logging
- 4:06Logging tools
- 9:05Data privacy laws
- 12:50GDPR Principle of Personal Data Processing
- 14:56GDPR Article 6
- 20:17Summary
- 21:43Data protection
- 22:17Data classification
- 24:09Examples of data classification
- 25:16How much security protection
- 25:46Production logs
- 28:00Protect locks
- 28:24In summary
- 28:47Special thanks
related talks
52mDeveloping privacy
25mSecure Your Logs Down to the Root
39mdev.privacy: GDPR in a nutshell
26mSecuring Containers: Preventing Data Leaks
01h 00mPrivacy and GDPR: What all developers should know
12mDesigning a Private Logging Pipeline
48mOWASP cautions against “insufficient logging & monitoring.” What does sufficient l...
54mEuropean Vacation: Leveraging GDPR for Security