XMas is coming, let’s bust a few myths about Santa and GDPR

XMas is coming, let’s bust a few myths about Santa and GDPR

I cannot say I like Santa. It is not possible to like/dislike him because I know he does not exist (or does he???).

But still, i fill uncomfortable saying Santa is not compliant with GDPR. So many kids will be disappointed if he cannot do his job. In fact, I am convinced that if Santa does exist, he is compliant with GDPR and is the first one who has ever been.

So let’s bust a few myths about Santa and GDPR.


Myth #1 : Santa is not compliant with article 4 of EU GDPR

There is no such thing as non compliance to Article 4 of EU GDPR

Well, article 4 is about definitions. So I don’t see how anyone can be non-compliant to this article. See official text.


Myth #2 : He needs consent to process data

Consent is not the only lawfull basis to process data. For Santa, there are two other possible lawful basis :

  • « processing is necessary in order to protect vital interests of the data subject or of another natural person » : I am pretty sure that it is in the vital interest of most parents that Santa delivers the long-awaited gifts on time. Do you imagine the crisis if there is nothing under the Xmas tree ?
  • « processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller ». Is there anyone willing to argue that Santa (if he exists) is not officially vested with authority to deliver Xmas presents and for that to process kids data ?


Myth #3 : He is not fulfilling right to be forgotten

Santa and GDPR's right to be forgotten

Yes he is keeping two lists. No a child name cannot be erase from the list.

No it is not inconsistent with Eu GDPR. Indeed, Santa has to keep the name on the list to fulfill his obligation. The parent put the child on the list because he does not want the naughty kid to get a Xmas present, right ?

But do not worry, Santa will erase all your data from any of his list the moment you become an adult (or the moment you start believing and saying he does not exist).

He is doing so and has always done so. So no worries Santa (if you exist), no one will file a complaint against you because of non-compliance to GDPR (except naughty people 😉 ).



Enjoy your Xmas.

Santa, Xmas and GDPR



Want to get more article like this, subscribe to our newsletter : follow this link