gdpr-ccpa-data-privacy

name	gdpr-ccpa-data-privacy
metadata	{"category":"Compliance Governance and Legal Tech"}
description	Engineering patterns for GDPR, CCPA/CPRA, and global data privacy compliance. Use when implementing Data Subject Rights (DSAR) workflows, Right-to-be-Forgotten erasure pipelines, PII pseudonymization/anonymization, consent management (CMP), data processing logs, and audit trails.
compatibility	Generic Backend (Node.js/Python/Go), PostgreSQL/MongoDB, Redis, AWS/GCP

GDPR, CCPA & Data Privacy Engineering Guidelines

This skill provides data architecture, encryption standards, PII pseudonymization patterns, consent state tracking, and automated Data Subject Access Request (DSAR) / Right-to-be-Forgotten deletion pipelines for privacy compliance under GDPR and CCPA/CPRA.

---

1. Data Privacy Architecture Framework

                          +-------------------------------+
                          |    User / Consent Front-End   |
                          |  (Cookie Banner / CMP Widget) |
                          +---------------+---------------+
                                          |
                                   Consent Telemetry
                                          v
+------------------+      +-------------------------------+
|  DSAR Request    | ---> | Privacy API & Orchestration   |
| (Export/Erasure) |      | (Tokenization & Workflow)     |
+------------------+      +---------------+---------------+
                                          |
                   +----------------------+----------------------+
                   |                      |                      |
          +--------v-------+     +--------v-------+     +--------v-------+
          | DB Crypt Key   |     | SQL/NoSQL DB   |     | Log Scrubbing  |
          | Manager (KMS)  |     |  Pseudonymized |     | Analytics Off  |
          +----------------+     +----------------+     +----------------+

1. Lawful Basis & Consent Tracking: Every data collection event must record explicit user consent timestamp, consent version, and specific purpose scope.
2. Right to Access (DSAR): Users can export all personal data stored across databases in structured machine-readable format (JSON/CSV).
3. Right to Erasure (Right to be Forgotten): Cascading deletion or cryptographic erasure of personal identifiable information (PII) within 30 statutory days.
4. Data Minimization & Pseudonymization: PII (emails, phone numbers, IP addresses) stored using salt-hashed tokens or envelope encryption.

---

2. PII Pseudonymization & Cryptographic Erasure (Python / SQLAlchemy)

Cryptographic Erasure (Crypto-Shredding) destroys the per-user cryptographic key, rendering encrypted PII irrecoverably unreadable without physically deleting relational transactional metrics.

import base64
import os
import hashlib
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from sqlalchemy import Column, String, Integer, DateTime, LargeBinary, Text
from sqlalchemy.ext.declarative import declarative_base

Base = declarative_base()

class CryptoShredder:
    """Manages per-user AES-GCM encryption key generation & destruction."""
    
    @staticmethod
    def generate_user_key() -> bytes:
        return AESGCM.generate_key(bit_length=256)

    @staticmethod
    def encrypt_pii(plaintext_data: str, user_key: bytes) -> str:
        aesgcm = AESGCM(user_key)
        nonce = os.urandom(12)
        ciphertext = aesgcm.encrypt(nonce, plaintext_data.encode('utf-8'), None)
        # Combine nonce + ciphertext base64 encoded
        return base64.b64encode(nonce + ciphertext).decode('utf-8')

    @staticmethod
    def decrypt_pii(encrypted_payload: str, user_key: bytes) -> str:
        data = base64.b64decode(encrypted_payload.encode('utf-8'))
        nonce = data[:12]
        ciphertext = data[12:]
        aesgcm = AESGCM(user_key)
        decrypted_bytes = aesgcm.decrypt(nonce, ciphertext, None)
         decrypted_bytes.decode()

 ():
    __tablename__ = 

     = Column(Integer, primary_key=)
    user_uuid = Column(String(), unique=, nullable=, index=)
    
    
    email_lookup_hash = Column(String(), unique=, nullable=, index=)
    
    
    encrypted_email = Column(Text, nullable=)
    encrypted_full_name = Column(Text, nullable=)
    

     () -> :
         hashlib.sha256((pii_value.lower().strip() + global_salt).encode()).hexdigest()

---

3. DSAR Automated Deletion Workflow (Node.js / Express)

const express = require('express');
const router = express.Router();

/**
 * Executes cascading Data Subject Deletion / Anonymization
 */
router.post('/privacy/dsar/erase', async (req, res) => {
  const { userId, requestVerificationToken } = req.body;

  // 1. Verify User Authorization & Identity
  if (!verifyDsarToken(userId, requestVerificationToken)) {
    return res.status(401).json({ error: 'Invalid or expired DSAR verification token' });
  }

  try {
    // 2. Begin Compliance Erasure Transaction
    await db.transaction(async (trx) => {
      // Step A: Destroy User Cryptographic Encryption Key in KMS (Crypto-shredding)
      await kmsKeyStore.deleteUserKey(userId, { transaction: trx });

      // Step B: Anonymize or Soft Delete User Record in Primary DB
      await trx('users')
        .where({ id: userId })
        .update({
          email: `erased_user_${userId}@privacy-deleted.local`,
          full_name: 'ANONYMIZED_DATA_SUBJECT',
          phone_number: null,
          status: ,
          :  ()
        });

      
       ()
        .({ : userId })
        .({ : , :  });

      
       ().({
        : ,
        : (userId),
        :  (),
        : 
      });
    });

     res.().({
      : ,
      : 
    });
  }  (error) {
    .(, error);
     res.().({ :  });
  }
});

. = router;

---

4. Anti-Patterns & Critical Pitfalls

Anti-Pattern	Severity	Consequence	Correct Pattern
Plaintext PII in application log files	Critical	GDPR fine up to 4% global turnover / $20M	Mask emails (j***[e-mail]), IP addresses, and tokens in loggers
Soft deleting rows while keeping PII in backup DBs	High	Non-compliance during privacy audit	Crypto-shred user KMS key so historical backups remain unreadable
Missing Opt-Out mechanisms for CCPA ("Do Not Sell")	High	CCPA/CPRA enforcement penalties	Provide explicit API endpoint & frontend button for data sharing opt-out
Storing user consent in local un-audited state	Medium	Unable to demonstrate legal compliance proof	Persist immutable consent log (user_id, version, timestamp, ip)
Broad wildcard SELECT queries returning PII to telemetry	Medium	Unintentional PII leakage to third-party analytics	Explicitly exclude PII columns in reporting queries

---

5. Privacy Compliance Verification Checklist

• Data Mapping Inventory: Maintain updated Data Flow Diagram (DFD) and Record of Processing Activities (ROPA).
• Consent CMP Integration: Confirm cookie categories (Necessary, Analytics, Marketing) block tags before user opt-in.
• Log Scrubbing Validation: Grep production logs for email regex patterns to verify zero plaintext PII leaks.
• DSAR SLA Monitoring: Automated alerts ensuring all access/erasure requests complete within 30 days.