GDPR Privacy — Cheat Sheet

Tags: gdpr, privacy, data-protection, compliance, security, backend

Level: intermediate

TL;DR: Core principles, legal bases, and technical patterns for handling personal data under GDPR in distributed web applications.

Key concepts

Personal data covers any identified or identifiable natural person, including IP addresses, cookie identifiers, and device fingerprints.

Processing requires one of six legal bases: consent, contract, legal obligation, vital interests, public task, or legitimate interest.

Data minimisation dictates collecting only data strictly necessary for the specified, explicit purpose.

Storage limitation requires defining and enforcing automated retention policies and deletion schedules.

Integrity and confidentiality mandate state-of-the-art technical safeguards, encryption at rest, and encryption in transit.

Privacy by design requires privacy protections to be built into system architecture from the earliest design phase.

Privacy by default ensures strictest privacy settings apply out-of-the-box without user intervention.

Pseudonymisation decouples direct identifiers from underlying records via deterministic hashing or surrogate keys.

Controllers define processing purposes and means; processors execute processing strictly on behalf of controllers.

Breach notification requires reporting high-risk personal data breaches to supervisory authorities within 72 hours.

Typical questions and ready answers

Q: How do you implement the Right to Erasure (Article 17) in systems with backups or immutable logs?R: I pseudonymise records using a per-user cryptographic key; deleting or rotating the key effectively renders backups cryptographically erased without breaking append-only storage.

Q: What is the architectural difference between pseudonymisation and anonymisation?R: Pseudonymised data can still be re-identified with auxiliary information and remains under GDPR scope; anonymised data is irreversible and completely exempt.

Q: How do you handle third-party data processors from an engineering perspective?R: I restrict forwarded payload fields through schema whitelisting, verify contractual DPAs, and route outbound integrations through isolated API gateways.

Q: How do you manage consent state across microservices?R: I emit versioned consent change events via a message broker to update domain read models and block downstream data processing workflows immediately.

Pitfalls and common mistakes

Logging sensitive personal data or raw authorization tokens into centralized logging services.

Using production database dumps directly in staging or development environments without data masking.

Assuming soft deletion meets Article 17 requirements while keeping records visible to analytics or downstream ETLs.

Relying on legitimate interest without running and documenting a formal Legitimate Interests Assessment (LIA).

Conflating basic aggregation with irreversible anonymisation on low-cardinality datasets.

Snippets and commandsTypeScript

// Example: deterministic HMAC pseudonymisation with tenant secret
import { createHmac } from "crypto";

export function pseudonymizeIdentifier(userId: string, secretKey: string): string {
  return createHmac("sha256", secretKey)
    .update(userId)
    .digest("hex");
}

SQL

```-- Automated data retention purge pattern

DELETE FROM user_activity_logs

WHERE recorded_at < NOW() - INTERVAL '90 days'

AND processing_basis = 'legitimate_interest';

```

To review

[ ] Implement crypto-shredding key management for distributed relational databases.

[ ] Audit application logging pipelines for accidental PII leakage.

[ ] Verify Data Processing Agreements (DPAs) for external SaaS telemetry vendors.

[x] Enforce TLS 1.3 across all internal and public service endpoints.

[x] Configure automated retention TTLs on event streams and session stores.

References

Regulation (EU) 2016/679 (General Data Protection Regulation)

EDPB Guidelines on Data Protection by Design and by Default (Article 25)

ENISA Recommendations on Shaping Technology According to GDPR Provisions