GDPR: can vendors accept core dumps or logs
<p>As a software vendor, am I allowed to accept core dumps or application logs from my customers to investigate a crash or malfunction even though they most likely contain personally identifiable information that may be subject to GDPR law?</p>

<p>It sounds like the rule of thumb "Do not keep personal information longer than necessary" covers this: the dump/logs are essential to help resolve a critical problem, and I would of course delete the dump and any logs sent to me as soon as I've found a solution.</p>

<p>However, since I am a software vendor external to the company the data was entrusted to, I am not so sure.</p>

<h2>If you comply with GDPR, yes</h2>

<p>However, if you are asking this question it seems that you have not taken the steps you need to take in order to comply.</p>

<h2>It depends.</h2>

<p>The GDPR doesn't prohibit the processing of personal data.</p>

<p>In your scenario you are the "processor" and your customer is the "controller". </p>

<blockquote>
  <p>‘controller’ means the natural or legal person, public authority,
  agency or other body which, alone or jointly with others, determines
  the purposes and means of the processing of personal data; where the
  purposes and means of such processing are determined by Union or
  Member State law, the controller or the specific criteria for its
  nomination may be provided for by Union or Member State law;</p>
  
  <p>‘processor’ means a natural or legal person, public authority, agency
  or other body which processes personal data on behalf of the
  controller;</p>
</blockquote>

<p>They can be the same entity but note that the obligations of the controller and processor differ. The obligations specific to the processor are given in Article 28, including what a contract between the controller and processor must say. Pay attention to section 10 to prevent you/your company from being considered to be a controller.</p>

<p>To mitigate risk, you and your customer might prefer the data to be anonymised before it is sent to you. Indeed anonymisation is obligatory if the job can be done without personal data. And if the data is anonymised then it won't engage GDPR. But if anonymised data prevents such an investigation, it doesn't necessarily mean you may not accept personal data, it 'just' means that you must process the data in compliance with GDPR.</p>

gdpr