Security7 min read

GDPR & Privacy Engineering

Build GDPR-compliant systems with privacy by design, consent management, data minimization, right-to-erasure implementation, and DPIAs.

gdprprivacycompliancedata-protection

GDPR (General Data Protection Regulation) mandates how personal data of EU residents must be collected, processed, and protected. Privacy engineering translates legal requirements into technical architecture-consent management, data minimization, and enforceable rights.

Privacy is a design constraint, not a legal checkbox. Build systems that collect minimum data, obtain valid consent, enforce data subject rights programmatically, and produce audit trails. Involve a DPO for high-risk processing.

Workflow

Establish lawful basis and data inventoryProcessing without lawful basis is the core GDPR violation; you must know what you process to protect it.
Implement privacy by designRetrofitting privacy is expensive; building it in is cheap.
Build consent managementConsent under GDPR must be freely given, specific, informed, and unambiguous-pre-ticked boxes are invalid.
Implement data subject rightsGDPR grants eight rights; failure to honor them within 30 days is a regulatory violation.
Conduct DPIAs and manage breachesHigh-risk processing requires prior DPIA; breaches must be reported within 72 hours.

Output Format

ROPA documented, consent records stored, data subject rights endpoints implemented, erasure tested, DPIA for high-risk processing, breach response plan.

Examples

Erasure endpoint: `DELETE /api/users/:id` - hard delete PII, replace with tombstone `{ id, deleted_at, reason: "erasure_request" }`, remove from email lists, pseudonymize in analytics events

Consent record: `{ userId, timestamp: "2026-08-01T10:00:00Z", consentVersion: "v3.2", purposes: ["analytics", "marketing"], withdrawn: null }`

Pseudonymization: store SHA-256(userId + salt) in analytics; salt rotated monthly-unlinkable without salt

Edge Cases & Gotchas

Backups: GDPR allows backup exception for erasure, but must document max retention and pseudonymize in backups within reasonable time
Third-party processors: you remain controller; ensure DPAs (Data Processing Agreements) are in place with every vendor
Right to erasure vs. legal hold: if data is under legal hold (litigation, tax), document and decline erasure with legal basis

When to Break These Rules

If processing only employee data for HR purposes (not EU customer data), simpler national employment law may apply instead of full GDPR.

Reference Files

GDPR full text: https://gdpr-info.eu/
ICO guidance: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/
CNIL recommendations: https://www.cnil.fr/en/home
OneTrust: https://www.onetrust.com/