> Most startups are doing their best to be good stewards of data, and they didn't need big global regulation to force them.

lol

> Most startups are doing their best to be good stewards of data, and they didn't need big global regulation to force them.

If that were true we wouldn't be seeing daily threads here (like this one) that effectively amount to "I don't want to follow the law/protect the data I collect" for months now.

I think it is an important point about "many things will remain that way with GDPR because of necessity (ie: old invoices and transactions will continue to have your details)". Most people doing business have _very_ legitimate reasons for having sensitive data; invoices, charges, security, etc. all require having personally identifying and sensitive information, and GDPR recognizes that-- but what it means is that companies _will_ and _should_ have customer information. Just because it isn't sitting in their database to improve customer experience doesn't mean it won't be sitting in the billing department for accounting & auditing purposes. So GDPR doesn't actually change much about people having your data, just kind of shuffles it around.

I’m not sure that delete=1 is a good idea, because you’re still mutating database records. But, it’s often lot cleaner conceptually to model state as an append-only log of assertions and retractions or via a log-structured system, where you never delete old records but just push a new index record that leaves the appropriate record out.