I am trying to understand the GDPR and data security implications of implementing server side google tag manager.
From what I know, we setup the tagging and preview servers in our infrastructure. The client (browser) sends the data to these servers. Clients are configured in GTM to send data to third party like GA4.
The process to create these servers are abstracted through containers and I do not know if it has a data store.
Are the requests sent to my servers stored in the google tag manager(GTM) tagging server or preview server? What are the GDPR implications if there is PII data in the requests? Ofcourse, we will redact PII data to GA4 but does it still reside in these servers and needs deletion periodically?
For the purpose of GDPR and PII, no, GTM doesn't store data. Therefore, no need for you to clean it up separately from your normal cleaning. This applies to both, client and server-side GTM.