Thanks @MyriamBoure I have been looking for some info from the CNIL but had a hard time finding the one that applies in our case.
About the diagram, there are some tools that allow to make them automatically from the source code, I’ll have a look at it there (it will be an opportunity for me to understand the code better anyway).
Regarding entreprise data, I’m not aware yet of how the the whole thing work here, but I know that an invoice MUST never be modified once edited. It means that even if the user is anonymised, his name will still be on the invoice. Because of that, what we did in a former project, was a second app that was only in charge of invoices, and which duplicated the data required by the invoice not to be further edited, independently from the main app. (This would be a step to Microservice architecture).
How are invoices handled at the moment?
I think No is the answer here, otherwise, we simply give the feeling that we allow deletion, but we’re still not CNIL-compliant.
Those ain’t a big deal either: previous data can be stored there, as long as backups are not kept longer than a certain amount of time. So we’ll have to make sure we delete backups after eg. 1 year, but that’s pretty healthy I think.
In general, from my experience, when it comes to legal stuff, the intent is very important. We can read further content on the topic, this won’t make us lawyer (unless we have some with us), so:
- Either we try to figure out a decent solution by ourselves keeping in mind that we have good intentions with the user data (but that doesn’t make us illegal I’d say)
- Or we’ll have to ask a lawyer for its expertise, but we also have to keep in mind that the law moves fast on this topic (there is a new one coming next spring).
What do you think?