| name | gdpr-compliance |
| description | Implement GDPR data protection requirements. Configure consent management, data subject rights, and privacy by design. Use when processing EU personal data. |
| license | MIT |
| metadata | {"author":"devops-skills","version":"1.0"} |
GDPR Compliance
Implement General Data Protection Regulation requirements for organizations that process personal data of EU/EEA residents, covering lawful processing, data subject rights, and technical safeguards.
When to Use
- Processing personal data of EU/EEA residents in any capacity
- Building consent management and preference centers
- Implementing Data Subject Access Request (DSAR) workflows
- Conducting Data Protection Impact Assessments (DPIAs)
- Setting up data processing agreements with third-party processors
- Designing systems with privacy by design and by default principles
Key Principles and Legal Bases
gdpr_principles:
article_5:
lawfulness_fairness_transparency:
description: "Process data lawfully, fairly, and transparently"
implementation:
- Document legal basis for every processing activity
- Provide clear privacy notices
- No hidden or deceptive data collection
purpose_limitation:
description: "Collect for specified, explicit, and legitimate purposes"
implementation:
- Define purpose before collection
- Do not repurpose data without new legal basis
- Document all processing purposes in ROPA
data_minimization:
description: "Adequate, relevant, and limited to what is necessary"
implementation:
- Collect only required fields
- Review data models for unnecessary fields
- Remove optional fields that are not used
accuracy:
description: "Accurate and kept up to date"
implementation:
- Provide self-service profile editing
- Implement data validation at point of entry
- Schedule regular data quality reviews
storage_limitation:
description: "Kept no longer than necessary"
implementation:
- Define retention periods per data category
- Automate deletion when retention expires
- Document retention schedule
integrity_and_confidentiality:
description: "Appropriate security measures"
implementation:
- Encryption at rest and in transit
- Access controls and audit logging
- Pseudonymization where appropriate
accountability:
description: "Demonstrate compliance"
implementation:
- Maintain Records of Processing Activities
- Conduct DPIAs for high-risk processing
- Appoint DPO if required
legal_bases:
article_6:
consent: "Freely given, specific, informed, unambiguous"
contract: "Necessary for performance of a contract"
legal_obligation: "Required by EU or member state law"
vital_interests: "Protect life of data subject or another person"
public_interest: "Task carried out in public interest"
legitimate_interest: "Legitimate interest not overridden by data subject rights"
Data Mapping Template (Records of Processing Activities)
processing_activity:
name: "Customer Account Management"
controller: "Example Corp, 123 Main St, Dublin, Ireland"
dpo_contact: "dpo@example.com"
purpose: "Manage customer accounts, provide services, handle billing"
legal_basis: "Contract (Art. 6(1)(b))"
categories_of_data_subjects:
- Customers
- Prospective customers
categories_of_personal_data:
- Name, email, phone number
- Billing address
- Payment information (tokenized)
- Service usage data
- Support ticket history
special_categories: "None"
recipients:
- Payment processor (Stripe) - processor
- Email service (SendGrid) -
[]
[]
[]
[]
[]
Consent Management Implementation
"""
Consent management system implementing GDPR Article 7 requirements.
Consent must be freely given, specific, informed, and unambiguous.
"""
from datetime import datetime, timezone
from enum import Enum
import json
import hashlib
class ConsentPurpose(Enum):
MARKETING_EMAIL = "marketing_email"
MARKETING_SMS = "marketing_sms"
ANALYTICS = "analytics"
PERSONALIZATION = "personalization"
THIRD_PARTY_SHARING = "third_party_sharing"
PROFILING = "profiling"
class ConsentManager:
def __init__(self, db):
self.db = db
def record_consent(self, user_id, purpose, granted, source,
privacy_policy_version, ip_address=None):
"""Record a consent decision with full audit trail."""
consent_record = {
"user_id": user_id,
"purpose": purpose.value,
"granted": granted,
"timestamp": datetime.now(timezone.utc).isoformat(),
"source": source,
"privacy_policy_version": privacy_policy_version,
"ip_address": ip_address,
"withdrawal_timestamp": None,
}
consent_record["record_hash"] = hashlib.sha256(
json.dumps(consent_record, sort_keys=).encode()
).hexdigest()
.db.consent_records.insert(consent_record)
consent_record
():
record = .record_consent(
user_id=user_id,
purpose=purpose,
granted=,
source=,
privacy_policy_version=,
)
._notify_processors(user_id, purpose, )
._stop_processing(user_id, purpose)
record
():
latest = .db.consent_records.find_one(
{: user_id, : purpose.value},
sort=[(, -)]
)
latest[] latest
():
(.db.consent_records.find(
{: user_id},
sort=[(, -)]
))
():
records = (.db.consent_records.find(
{: user_id, : purpose.value},
sort=[(, )]
))
{
: user_id,
: purpose.value,
: records,
: .get_consent_status(user_id, purpose),
: datetime.now(timezone.utc).isoformat(),
}
():
():
Data Subject Access Request (DSAR) Procedures
dsar_workflow:
step_1_receive:
actions:
- Log the request with timestamp and channel received
- Assign unique tracking ID
- Acknowledge receipt within 3 business days
identity_verification:
- Verify identity before providing any data
- Use existing authentication where possible
- Request additional proof if necessary (but not excessive)
sla: "Must respond within 30 days (extendable to 90 days for complex requests)"
step_2_assess:
actions:
- Determine request type (access,
"""DSAR automation - data collection across systems."""
import json
from datetime import datetime, timezone
class DSARProcessor:
def __init__(self, data_sources):
self.data_sources = data_sources
def process_access_request(self, user_identifier):
"""Collect all personal data across registered systems."""
collected_data = {
"request_id": f"DSAR-{datetime.now(timezone.utc).strftime('%Y%m%d%H%M%S')}",
"generated_at": datetime.now(timezone.utc).isoformat(),
"data_subject": user_identifier,
"systems": {},
}
for system_name, source in self.data_sources.items():
try:
data = source.extract_user_data(user_identifier)
collected_data["systems"][system_name] = {
"status": "collected",
"record_count": len(data) if isinstance(data, list) else 1,
"data": data,
}
except Exception as e:
collected_data["systems"][system_name] = {
"status": "error",
: (e),
}
collected_data
():
results = {
: ,
: user_identifier,
: {},
}
system_name, source .data_sources.items():
:
deleted = source.delete_user_data(user_identifier)
retained = source.get_retained_data(user_identifier)
results[][system_name] = {
: ,
: deleted,
: retained,
: source.retention_legal_basis,
}
Exception e:
results[][system_name] = {
: ,
: (e),
}
results
():
data = .process_access_request(user_identifier)
== :
json.dumps(data, indent=, default=)
== :
._convert_to_csv(data)
ValueError()
Data Processing Agreement (DPA) Requirements
dpa_requirements:
mandatory_clauses:
article_28:
- Subject matter, duration, nature, and purpose of processing
- Type of personal data and categories of data subjects
- Obligations and rights of the controller
- Processing only on documented instructions from controller
- Confidentiality obligations on processor personnel
- Appropriate technical and organizational security measures
- Conditions for engaging sub-processors (prior authorization)
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
Data Protection Impact Assessment (DPIA) Template
dpia_template:
when_required:
- Systematic and extensive profiling with significant effects
- Large-scale processing of special category data
- Systematic monitoring of publicly accessible areas
- Any processing on national supervisory authority's list
- New technologies with likely high risk to rights and freedoms
assessment:
section_1_description:
processing_activity: ""
purpose: ""
legal_basis: ""
data_categories: []
data_subjects: []
recipients: []
retention: ""
GDPR Compliance Checklist
gdpr_compliance_checklist:
governance:
- [ ] Data Protection Officer appointed (if required under Art. 37)
- [ ] Records of Processing Activities (ROPA) maintained
- [ ] Privacy policies published and up to date
- [ ] Data protection training conducted for all staff
- [ ] Data breach response plan documented and tested
lawful_processing:
- [ ] Legal basis identified and documented for each processing activity
- [ ] Consent mechanisms
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
[ ]
Best Practices
- Maintain a comprehensive Records of Processing Activities as the foundation of GDPR compliance
- Implement privacy by design: build data protection into systems from the start, not retrofitted
- Apply data minimization rigorously: do not collect personal data "just in case"
- Automate DSAR processing to meet the 30-day response deadline consistently
- Keep consent granular and purpose-specific; avoid bundled consent for multiple purposes
- Conduct DPIAs before launching high-risk processing activities
- Ensure data processing agreements are signed with every processor before sharing personal data
- Implement automated retention enforcement to prevent storage beyond defined periods
- Train all staff who handle personal data, not just the IT and legal teams
- Regularly audit data flows to discover shadow processing or undocumented data stores
