The document discusses how Santa Claus would not be compliant with the EU's General Data Protection Regulation (GDPR) which takes effect in May 2018. Santa maintains a "list" with personal information on EU citizens to determine who is naughty or nice and to deliver appropriate gifts. However, under GDPR, individuals have the right to access any data an organization holds on them and to request deletion of personal data. As Santa does not have systems in place to accommodate these rights, Christmas 2018 would have to be cancelled due to his lack of GDPR compliance.

1. The Real Cost of GDPR:
Christmas will have to be
cancelled - Santa is not GDPR
compliant

2. With the deadline of
May 25th, 2018
looming, organisations
are hustling to become
compliant with the
EU’s General Data
Protection Regulation
(GDPR).

3. However, it appears that GDPR may have a
completely unintended consequence.
Yes, we’re sorry to have to tell you this, but as a
supplier of technology that enables firms to
comply with GDPR….

4. ...Christmas 2018
is going to have
to be cancelled.

5. It must have been the snow in
London last week that turned
our minds to Christmas and all
the joy, bonhomie and gift
giving (and receiving) that
comes with it.

6. But then, as our team worked on a GDPR
customer case, the two realities came crashing
together in one horrible and oh so vivid flash of
realisation; Santa is not GDPR compliant.

7. If an organisation collects, stores or
processes information about EU nationals,
GDPR applies - regardless of where the
organisation itself is based.
Santa’s list includes
EU citizens.

8. Is the data personal? Santa provides perhaps the
most tailored gift-giving service in the world
(sorry Mr. Bezos…)
Santa works with
personal data of EU
citizens.

9. Conclusion
GDPR applies to Santa.

10. GDPR, in essence, involves two check
boxes. If an organisation checks both
boxes, then there are consequences.

11. 1. Under GDPR any EU citizen can
ask an organisation to provide a
copy of the data they hold on
them.
Has anyone ever written to Santa
and actually gotten a reply?
That's Strike 1 for Santa

12. 2. Any EU citizen must be able to request that
the personal data held on them by the company
is deleted.
Santa doesn’t have a customer support channel
and is unable to comply with delete requests.
Strike 2 for Santa.
Santa is clearly not GDPR
compliant. Christmas will have to
be cancelled.
Sorry.

13. GDPR compliance is actually pretty tough for
businesses - If you’re not that worried about Santa or
perhaps you don’t even believe in Santa (what!?), but
you’d still like to learn more about GDPR, check out
our blog.
http://www.10duke.com/resources/blog/
Or contact us to find out how you can make GDPR
compliance as simple as clicking a button.
10Duke.com