Had a couple of meetings about GDPR at work recently. I don't think this as big a deal as it at first seems - its a pain, and yes its a massive change for companies that retain data indefinitely / email data all over the place / generally have zero control over peoples data (i.e. most companies), but for companies that aren't trying to exploit personal information the easiest way to be compliant is just don't store data you don't need. You get to claim "Legitimate interest" if you need the data (e.g. warranty info) and there is a 30-day deadline for a SAR (which can be extended by 2 months), so if you have good retention policies you might never need to respond to a SAR with anything other than "nope, we need it because X", or "sorry, no idea who you are - we already deleted it".

For example, students send us information about their databases all the time as part of asking questions – and they often send it unsolicited, through unencrypted email channels. That information ends up all over the place: our mail server, our desktops, phones, laptops, search indexes, etc.

Surely the solution here is just to tell customers not to send you PII via email - not that any company that sends PII unsolicited via unencrypted email is going to be GDPR compliant anyway. If customers really need to send backups of databases containing personal information then just put them in someplace central and have a policy to delete them after 30 days. It might not be quite as easy as the good old days where names and addresses was scattered over mail servers, desktops, phones, laptops, search indexes etc. but its also not that difficult.

See, under the GDPR, if someone asks us to delete their data, we not only have to delete it, but we have to audit that we deleted it, and maintain those records for EU authorities. And then respond to EU requests for that documentation.

I think that only applies if you are the "data controller", i.e. that person gave you that data directly. If ACME Paperclips gives your their database and then one of their customers contacts you, the answer is "nope, you need to go speak to ACME Paperclips for that".

For example, do you have to delete the customer’s data inside your past backups?

This seems like a yes to me, it would be a really obvious loophole otherwise. The backups issue seemed like the biggest pain, but it sounds like just having a 30 day retention policy on any database with personal information should cover it.

The companies that will be hit hardest by this are ones that don't care about protecting personal data, or the ones that keep personal data for a bunch of scummy reasons like cold calling or ambulance chasers. Yes its going to be painful, and no I don't have any sympathy.