GDPR considerations

[ebinbellini]

• Only administratrators, internal auditors and the board should have read access to everything. (what about FUM?)
• Should old data be automatically deleted after 2 years?
• Should statistics be kept? For example the total amount of applications and appointments in a year.
• If we don't delete old data automatically, at least make it easy to clear out old data.
• Is there anything else we need to consider?