compliance-patterns

name	compliance-patterns
description	GDPR data handling, audit logging, data classification, retention policies, and consent management for regulatory compliance.

Compliance Patterns

Data governance and regulatory compliance patterns for software systems.

Data Classification

// Tag every data field with its classification level
enum DataClass {
  PUBLIC = 'public',           // Marketing content, product info
  INTERNAL = 'internal',       // Business metrics, employee count
  CONFIDENTIAL = 'confidential', // Customer emails, order history
  RESTRICTED = 'restricted',   // Passwords, SSN, payment cards, health data
}

// Schema-level classification
interface UserRecord {
  id: string                    // INTERNAL
  email: string                 // CONFIDENTIAL (PII)
  displayName: string           // CONFIDENTIAL (PII)
  passwordHash: string          // RESTRICTED
  dateOfBirth: string           // RESTRICTED (sensitive PII)
  preferences: object           // INTERNAL
  createdAt: Date              // INTERNAL
}

// Field-level encryption for RESTRICTED data
const ENCRYPTED_FIELDS: Record<string, DataClass> = {
  'user.email': DataClass.CONFIDENTIAL,
  'user.dateOfBirth': DataClass.RESTRICTED,
  'user.ssn': DataClass.RESTRICTED,
  'payment.cardNumber': DataClass.RESTRICTED,
}

function shouldEncryptAtRest(fieldPath: string): boolean {
  const classification = ENCRYPTED_FIELDS[fieldPath]
  return classification === DataClass.RESTRICTED
}

function shouldMaskInLogs(fieldPath: string): boolean {
  const classification = ENCRYPTED_FIELDS[fieldPath]
  return classification === DataClass.CONFIDENTIAL || classification === DataClass.RESTRICTED
}

Audit Logging

interface AuditEvent {
  id: string
  timestamp: string         // ISO 8601
  actor: {
    id: string
    type: 'user' | 'system' | 'admin'
    ip?: string
  }
  action: string            // e.g., 'user.profile.updated', 'order.deleted'
  resource: {
    type: string
    id: string
  }
  changes?: {
    field: string
    oldValue: unknown       // Masked if RESTRICTED
    newValue: unknown       // Masked if RESTRICTED
  }[]
  metadata?: Record<string, unknown>
  result: 'success' | 'failure' | 'denied'
  reason?: string           // For denied/failure
}

class AuditLogger {
  constructor(private store: AuditStore) {}

  async log(: <,  | >): <> {
     :  = {
      ...event,
      : crypto.(),
      :  ().(),
      : event.?.( ({
        ...c,
        : (c.) ?  : c.,
        : (c.) ?  : c.,
      })),
    }

    
     ..(auditEvent)
  }
}


 () {
    (: , : , : ) => {
     originalJson = res..(res)

    res. = () {
       ([, , , ].(req.)) {
        auditLogger.({
          : { : req.?. ?? , : , : req. },
          : ,
          : { : req..()[], : req.. ??  },
          : res. <  ?  : ,
        }).( .(, err))
      }
       (body)
    }

    ()
  }
}

GDPR Data Subject Rights

// Right to Access (Article 15): export all user data
async function exportUserData(userId: string): Promise<DataExport> {
  const user = await db.user.findUnique({ where: { id: userId } })
  const orders = await db.order.findMany({ where: { userId } })
  const activityLog = await db.activityLog.findMany({ where: { userId } })
  const consents = await db.consent.findMany({ where: { userId } })

  return {
    exportDate: new Date().toISOString(),
    subject: { id: userId, email: user?.email },
    personalData: {
      profile: sanitizeForExport(user),
      orders: orders.map(sanitizeForExport),
      activity: activityLog,
      consents,
    },
    format: 'JSON',
    version: '1.0',
  }
}

// Right to Erasure (Article 17): delete user data
  (): <> {
   :  = { userId, :  (), : [] }

  
   db..({
    : { : userId },
    : { : , :  () }
  })
  report..({ : , :  })

  
   { count } =  db..({ : { userId } })
  report..({ : , : , count })

  
   db..({
    : { userId },
    : { : , :  }
  })
  report..({ : , :  })

  
   auditLogger.({
    : { : userId, :  },
    : ,
    : { : , : userId },
    : ,
  })

   report
}

Consent Management

interface ConsentRecord {
  userId: string
  purpose: string           // 'marketing', 'analytics', 'third_party_sharing'
  granted: boolean
  grantedAt: Date
  expiresAt?: Date
  source: string            // 'signup_form', 'settings_page', 'cookie_banner'
  version: string           // Consent text version (re-consent needed on change)
}

async function checkConsent(userId: string, purpose: string): Promise<boolean> {
  const consent = await db.consent.findFirst({
    where: {
      userId,
      purpose,
      granted: true,
      OR: [
        { expiresAt: null },
        { expiresAt: { gt: new Date() } },
      ],
    }
  })
  return consent !== null
}

// Guard: only process data if consent exists
async function sendMarketingEmail(userId: ): <> {
   hasConsent =  (userId, )
   (!hasConsent) {
    .()
    
  }
   emailService.(userId, marketingTemplate)
}

Retention Policies

// Automated data retention enforcement
const RETENTION_POLICIES: RetentionPolicy[] = [
  { dataType: 'session_logs', retentionDays: 90, action: 'delete' },
  { dataType: 'audit_logs', retentionDays: 2555, action: 'archive' },  // 7 years
  { dataType: 'user_activity', retentionDays: 365, action: 'anonymize' },
  { dataType: 'deleted_accounts', retentionDays: 30, action: 'purge' },
]

async function enforceRetention(): Promise<RetentionReport> {
  const report: RetentionReport = { executedAt: new Date(), actions: [] }

  for (const policy of RETENTION_POLICIES) {
    const cutoffDate = new Date()
    cutoffDate.setDate(cutoffDate.getDate() - policy.retentionDays)

     count =  (policy., cutoffDate, policy.)
    report..({
      : policy.,
      : policy.,
      : count,
      cutoffDate,
    })
  }

   report
}

Checklist

• Every data field classified (PUBLIC/INTERNAL/CONFIDENTIAL/RESTRICTED)
• RESTRICTED data encrypted at rest and in transit
• PII masked in all log outputs (never log raw email, SSN, card numbers)
• Audit log: immutable, append-only, captures who/what/when/result
• Data export endpoint (GDPR Article 15 - Right to Access)
• Data deletion/anonymization endpoint (GDPR Article 17 - Right to Erasure)
• Consent records with purpose, timestamp, version, and expiry
• Retention policies enforced automatically (daily cron)
• Data Processing Agreement (DPA) with all third-party processors

Anti-Patterns

• Logging PII in application logs (searchable by anyone with log access)
• Hard-deleting without audit trail (no proof of compliance)
• Single "I agree" checkbox for all purposes (GDPR requires granular consent)
• Retaining data indefinitely "just in case" (violates data minimization)
• Consent version not tracked: consent invalidated when terms change
• No data inventory: unable to locate all PII for subject access requests