gdpr-compliance

name	gdpr-compliance
description	Implement GDPR data protection requirements. Configure consent management, data subject rights, and privacy by design. Use when processing EU personal data.
license	MIT
metadata	{"author":"devops-skills","version":"1.0"}

GDPR Compliance

Implement General Data Protection Regulation requirements for organizations that process personal data of EU/EEA residents, covering lawful processing, data subject rights, and technical safeguards.

When to Use

• Processing personal data of EU/EEA residents in any capacity
• Building consent management and preference centers
• Implementing Data Subject Access Request (DSAR) workflows
• Conducting Data Protection Impact Assessments (DPIAs)
• Setting up data processing agreements with third-party processors
• Designing systems with privacy by design and by default principles

Key Principles and Legal Bases

gdpr_principles:
  article_5:
    lawfulness_fairness_transparency:
      description: "Process data lawfully, fairly, and transparently"
      implementation:
        - Document legal basis for every processing activity
        - Provide clear privacy notices
        - No hidden or deceptive data collection

    purpose_limitation:
      description: "Collect for specified, explicit, and legitimate purposes"
      implementation:
        - Define purpose before collection
        - Do not repurpose data without new legal basis
        - Document all processing purposes in ROPA

    data_minimization:
      description: "Adequate, relevant, and limited to what is necessary"
      implementation:
        - Collect only required fields
        - Review data models for unnecessary fields
        - Remove optional fields that are not used

    accuracy:
      description: "Accurate and kept up to date"
      implementation:
        - Provide self-service profile editing
        - Implement data validation at point of entry
        - Schedule regular data quality reviews

    storage_limitation:
      description: "Kept no longer than necessary"
      implementation:
        - Define retention periods per data category
        - Automate deletion when retention expires
        - Document retention schedule

    integrity_and_confidentiality:
      description: "Appropriate security measures"
      implementation:
        - Encryption at rest and in transit
        - Access controls and audit logging
        - Pseudonymization where appropriate

    accountability:
      description: "Demonstrate compliance"
      implementation:
        - Maintain Records of Processing Activities
        - Conduct DPIAs for high-risk processing
        - Appoint DPO if required

legal_bases:
  article_6:
    consent: "Freely given, specific, informed, unambiguous"
    contract: "Necessary for performance of a contract"
    legal_obligation: "Required by EU or member state law"
    vital_interests: "Protect life of data subject or another person"
    public_interest: "Task carried out in public interest"
    legitimate_interest: "Legitimate interest not overridden by data subject rights"

Data Mapping Template (Records of Processing Activities)

# Record of Processing Activities (ROPA) - Article 30
processing_activity:
  name: "Customer Account Management"
  controller: "Example Corp, 123 Main St, Dublin, Ireland"
  dpo_contact: "[e-mail]"
  purpose: "Manage customer accounts, provide services, handle billing"
  legal_basis: "Contract (Art. 6(1)(b))"
  categories_of_data_subjects:
    - Customers
    - Prospective customers
  categories_of_personal_data:
    - Name, email, phone number
    - Billing address
    - Payment information (tokenized)
    - Service usage data
    - Support ticket history
  special_categories: "None"
  recipients:
    - Payment processor (Stripe) - processor
    - Email service (SendGrid) - 
         
  
       
       
       
   
  
        
        
       
         
   
   



   
   
     
     
   
   
     
     
   []
   []
     
   []
   []
   
   []
   
   
   

Consent Management Implementation

"""
Consent management system implementing GDPR Article 7 requirements.
Consent must be freely given, specific, informed, and unambiguous.
"""
from datetime import datetime, timezone
from enum import Enum
import json
import hashlib


class ConsentPurpose(Enum):
    MARKETING_EMAIL = "marketing_email"
    MARKETING_SMS = "marketing_sms"
    ANALYTICS = "analytics"
    PERSONALIZATION = "personalization"
    THIRD_PARTY_SHARING = "third_party_sharing"
    PROFILING = "profiling"


class ConsentManager:
    def __init__(self, db):
        self.db = db

    def record_consent(self, user_id, purpose, granted, source,
                       privacy_policy_version, ip_address=None):
        """Record a consent decision with full audit trail."""
        consent_record = {
            "user_id": user_id,
            "purpose": purpose.value,
            "granted": granted,
            "timestamp": datetime.now(timezone.utc).isoformat(),
            "source": source,  # e.g., "web_signup", "preference_center", "cookie_banner"
            "privacy_policy_version": privacy_policy_version,
            "ip_address": ip_address,
            "withdrawal_timestamp": None,
        }
        # Store with immutable audit trail
        consent_record["record_hash"] = hashlib.sha256(
            json.dumps(consent_record, sort_keys=).encode()
        ).hexdigest()
        .db.consent_records.insert(consent_record)
         consent_record

     ():
        
        record = .record_consent(
            user_id=user_id,
            purpose=purpose,
            granted=,
            source=,
            privacy_policy_version=,
        )
        
        ._notify_processors(user_id, purpose, )
        ._stop_processing(user_id, purpose)
         record

     ():
        
        latest = .db.consent_records.find_one(
            {: user_id, : purpose.value},
            sort=[(, -)]
        )
         latest[]  latest  

     ():
        
         (.db.consent_records.find(
            {: user_id},
            sort=[(, -)]
        ))

     ():
        
        records = (.db.consent_records.find(
            {: user_id, : purpose.value},
            sort=[(, )]
        ))
         {
            : user_id,
            : purpose.value,
            : records,
            : .get_consent_status(user_id, purpose),
            : datetime.now(timezone.utc).isoformat(),
        }

     ():
        
          

     ():
        
          

Data Subject Access Request (DSAR) Procedures

dsar_workflow:
  step_1_receive:
    actions:
      - Log the request with timestamp and channel received
      - Assign unique tracking ID
      - Acknowledge receipt within 3 business days
    identity_verification:
      - Verify identity before providing any data
      - Use existing authentication where possible
      - Request additional proof if necessary (but not excessive)
    sla: "Must respond within 30 days (extendable to 90 days for complex requests)"

  step_2_assess:
    actions:
      - Determine request type (access,    
             
               
               

  
    
         
        
         
        
         
           
          
           

  
    
                 
             
                
           
    
           
            
    
            
            
           
                 
    
             
              
               

  
    
           
           
           
              

"""DSAR automation - data collection across systems."""
import json
from datetime import datetime, timezone


class DSARProcessor:
    def __init__(self, data_sources):
        self.data_sources = data_sources  # Dict of system_name: DataSource

    def process_access_request(self, user_identifier):
        """Collect all personal data across registered systems."""
        collected_data = {
            "request_id": f"DSAR-{datetime.now(timezone.utc).strftime('%Y%m%d%H%M%S')}",
            "generated_at": datetime.now(timezone.utc).isoformat(),
            "data_subject": user_identifier,
            "systems": {},
        }

        for system_name, source in self.data_sources.items():
            try:
                data = source.extract_user_data(user_identifier)
                collected_data["systems"][system_name] = {
                    "status": "collected",
                    "record_count": len(data) if isinstance(data, list) else 1,
                    "data": data,
                }
            except Exception as e:
                collected_data["systems"][system_name] = {
                    "status": "error",
                    : (e),
                }

         collected_data

     ():
        
        results = {
            : ,
            : user_identifier,
            : {},
        }

         system_name, source  .data_sources.items():
            :
                deleted = source.delete_user_data(user_identifier)
                retained = source.get_retained_data(user_identifier)
                results[][system_name] = {
                    : ,
                    : deleted,
                    : retained,  
                    : source.retention_legal_basis,
                }
             Exception  e:
                results[][system_name] = {
                    : ,
                    : (e),
                }

         results

     ():
        
        data = .process_access_request(user_identifier)
          == :
             json.dumps(data, indent=, default=)
          == :
             ._convert_to_csv(data)
         ValueError()

Data Processing Agreement (DPA) Requirements

dpa_requirements:
  mandatory_clauses:
    article_28:
      - Subject matter, duration, nature, and purpose of processing
      - Type of personal data and categories of data subjects
      - Obligations and rights of the controller
      - Processing only on documented instructions from controller
      - Confidentiality obligations on processor personnel
      - Appropriate technical and organizational security measures
      - Conditions for engaging sub-processors (prior authorization)
            
            
              
             

  
     [ ]       
     [ ]       
     [ ]      
     [ ]       
     [ ]      

  
    
             
             
             
              
    
       [ ]      
       [ ]    
       [ ]     
       [ ]     

  
    
           
         
         
          
            
         
         

Data Protection Impact Assessment (DPIA) Template

dpia_template:
  when_required:
    - Systematic and extensive profiling with significant effects
    - Large-scale processing of special category data
    - Systematic monitoring of publicly accessible areas
    - Any processing on national supervisory authority's list
    - New technologies with likely high risk to rights and freedoms

  assessment:
    section_1_description:
      processing_activity: ""
      purpose: ""
      legal_basis: ""
      data_categories: []
      data_subjects: []
      recipients: []
      retention: ""
       

    
       
       
       
       

    
      
          
           
           
           
           
           

          
           
           
           
           
           

          
           
           
           
           
           

    
      
            
                 
             
            
      
             
             
           
           
      
              
              
           

    
       
       
       
       
       

GDPR Compliance Checklist

gdpr_compliance_checklist:
  governance:
    - [ ] Data Protection Officer appointed (if required under Art. 37)
    - [ ] Records of Processing Activities (ROPA) maintained
    - [ ] Privacy policies published and up to date
    - [ ] Data protection training conducted for all staff
    - [ ] Data breach response plan documented and tested

  lawful_processing:
    - [ ] Legal basis identified and documented for each processing activity
    - [ ] Consent mechanisms        
     [ ]        
     [ ]      
     [ ]         

  
     [ ]      
     [ ]    
     [ ]       
     [ ]      
     [ ]    
     [ ]        
     [ ]       
     [ ]        

  
     [ ]          
     [ ]    
     [ ]     
     [ ]      
     [ ]      
     [ ]    

  
     [ ]       
     [ ]     
     [ ]      
     [ ]    
     [ ]    

  
     [ ]      
     [ ]      
     [ ]      
     [ ]   
     [ ]     

Best Practices

• Maintain a comprehensive Records of Processing Activities as the foundation of GDPR compliance
• Implement privacy by design: build data protection into systems from the start, not retrofitted
• Apply data minimization rigorously: do not collect personal data "just in case"
• Automate DSAR processing to meet the 30-day response deadline consistently
• Keep consent granular and purpose-specific; avoid bundled consent for multiple purposes
• Conduct DPIAs before launching high-risk processing activities
• Ensure data processing agreements are signed with every processor before sharing personal data
• Implement automated retention enforcement to prevent storage beyond defined periods
• Train all staff who handle personal data, not just the IT and legal teams
• Regularly audit data flows to discover shadow processing or undocumented data stores