gdpr data-protection
Is the GDPR applicable to data stored in human memory?
<p>If data is stored in human memory, is the GDPR applicable?</p>

<p>Say, an employee of a company remembers an email address of a client, their date of birth, or even what their face looks like, does the client have a right of access to this data, or even a right for this to be erased?</p>

<p>GDPR forces companies <strong>and employees</strong> to keep personal data confidential and to use it only for its allowed uses. That obligation continues after the work contract ends.</p>

<p>If the employee breaches confidentiality, it does not matter if he provides the data as a file in an USB-drive or if he provides it from memory; it is a breach of confidentiality.</p>

<p>Access logs will help to determine which employees have had access to your data, in case a leak is suspected.</p>

<p>The part of the question about human memory seems to come from a deep misunderstanding of how human memory works<sup>1</sup>. I can remember tomorrow something that I have totally forgotten now. Even worse, there is no telling of what can make me remember you; your name might not ring a bell but I may remember you by seeing someone walking a dog. And nobody will ever be able to tell if I have complied with any of your requests or if I am just lying.</p>

<p>And of course, there is only one proven way to erase memories, and I am pretty sure the GDPR does not allow for the execution of employees (Disclaimer: IANAL and IANYL, check with a lawyer before murdering anyone if you have doubts).</p>

<p><hr/>
<sup>1</sup> The classical example: You can certainly delete a file from a disk. But <a href="http://www.apa.org/monitor/2011/10/unwanted-thoughts.aspx" rel="nofollow noreferrer">just try to stop thinking about white bears</a></p>

<p>No.</p>

<p>The GDPR only applies to "processing" of personal data.  What happens inside the human mind is not "processing" as defined by the GDPR - so there is no right to access and no right to erasure, etc.</p>
