--- name: gdpr-ccpa-data-privacy metadata: category: Compliance Governance and Legal Tech description: Engineering patterns for GDPR, CCPA/CPRA, and global data privacy compliance. Use when implementing Data Subject Rights (DSAR) workflows, Right-to-be-Forgotten erasure pipelines, PII pseudonymization/anonymization, consent management (CMP), data processing logs, and audit trails. compatibility: Generic Backend (Node.js/Python/Go), PostgreSQL/MongoDB, Redis, AWS/GCP --- # GDPR, CCPA & Data Privacy Engineering Guidelines This skill provides data architecture, encryption standards, PII pseudonymization patterns, consent state tracking, and automated Data Subject Access Request (DSAR) / Right-to-be-Forgotten deletion pipelines for privacy compliance under GDPR and CCPA/CPRA. --- ## 1. Data Privacy Architecture Framework ``` +-------------------------------+ | User / Consent Front-End | | (Cookie Banner / CMP Widget) | +---------------+---------------+ | Consent Telemetry v +------------------+ +-------------------------------+ | DSAR Request | ---> | Privacy API & Orchestration | | (Export/Erasure) | | (Tokenization & Workflow) | +------------------+ +---------------+---------------+ | +----------------------+----------------------+ | | | +--------v-------+ +--------v-------+ +--------v-------+ | DB Crypt Key | | SQL/NoSQL DB | | Log Scrubbing | | Manager (KMS) | | Pseudonymized | | Analytics Off | +----------------+ +----------------+ +----------------+ ``` 1. **Lawful Basis & Consent Tracking**: Every data collection event must record explicit user consent timestamp, consent version, and specific purpose scope. 2. **Right to Access (DSAR)**: Users can export all personal data stored across databases in structured machine-readable format (JSON/CSV). 3. **Right to Erasure (Right to be Forgotten)**: Cascading deletion or cryptographic erasure of personal identifiable information (PII) within 30 statutory days. 4. **Data Minimization & Pseudonymization**: PII (emails, phone numbers, IP addresses) stored using salt-hashed tokens or envelope encryption. --- ## 2. PII Pseudonymization & Cryptographic Erasure (Python / SQLAlchemy) Cryptographic Erasure (Crypto-Shredding) destroys the per-user cryptographic key, rendering encrypted PII irrecoverably unreadable without physically deleting relational transactional metrics. ```python import base64 import os import hashlib from cryptography.hazmat.primitives.ciphers.aead import AESGCM from sqlalchemy import Column, String, Integer, DateTime, LargeBinary, Text from sqlalchemy.ext.declarative import declarative_base Base = declarative_base() class CryptoShredder: """Manages per-user AES-GCM encryption key generation & destruction.""" @staticmethod def generate_user_key() -> bytes: return AESGCM.generate_key(bit_length=256) @staticmethod def encrypt_pii(plaintext_data: str, user_key: bytes) -> str: aesgcm = AESGCM(user_key) nonce = os.urandom(12) ciphertext = aesgcm.encrypt(nonce, plaintext_data.encode('utf-8'), None) # Combine nonce + ciphertext base64 encoded return base64.b64encode(nonce + ciphertext).decode('utf-8') @staticmethod def decrypt_pii(encrypted_payload: str, user_key: bytes) -> str: data = base64.b64decode(encrypted_payload.encode('utf-8')) nonce = data[:12] ciphertext = data[12:] aesgcm = AESGCM(user_key) decrypted_bytes = aesgcm.decrypt(nonce, ciphertext, None) return decrypted_bytes.decode('utf-8') class UserAccount(Base): __tablename__ = 'user_accounts' id = Column(Integer, primary_key=True) user_uuid = Column(String(36), unique=True, nullable=False, index=True) # Store pseudonymized lookup hash (for querying without revealing raw email) email_lookup_hash = Column(String(64), unique=True, nullable=False, index=True) # Encrypted PII Fields encrypted_email = Column(Text, nullable=False) encrypted_full_name = Column(Text, nullable=False) @staticmethod def hash_pii_for_lookup(pii_value: str, global_salt: str) -> str: return hashlib.sha256((pii_value.lower().strip() + global_salt).encode('utf-8')).hexdigest() ``` --- ## 3. DSAR Automated Deletion Workflow (Node.js / Express) ```javascript const express = require('express'); const router = express.Router(); /** * Executes cascading Data Subject Deletion / Anonymization */ router.post('/privacy/dsar/erase', async (req, res) => { const { userId, requestVerificationToken } = req.body; // 1. Verify User Authorization & Identity if (!verifyDsarToken(userId, requestVerificationToken)) { return res.status(401).json({ error: 'Invalid or expired DSAR verification token' }); } try { // 2. Begin Compliance Erasure Transaction await db.transaction(async (trx) => { // Step A: Destroy User Cryptographic Encryption Key in KMS (Crypto-shredding) await kmsKeyStore.deleteUserKey(userId, { transaction: trx }); // Step B: Anonymize or Soft Delete User Record in Primary DB await trx('users') .where({ id: userId }) .update({ email: `erased_user_${userId}@privacy-deleted.local`, full_name: 'ANONYMIZED_DATA_SUBJECT', phone_number: null, status: 'DELETED_GDPR_DSAR', deleted_at: new Date() }); // Step C: Scrub PII from Support Tickets / Comments await trx('comments') .where({ author_id: userId }) .update({ author_ip: '0.0.0.0', author_name: 'Anonymous User' }); // Step D: Write immutable compliance audit log await trx('privacy_audit_logs').insert({ event_type: 'GDPR_RIGHT_TO_ERASURE_EXECUTED', user_id_hash: hashUserId(userId), executed_at: new Date(), status: 'SUCCESS' }); }); return res.status(200).json({ status: 'SUCCESS', message: 'User personal data has been erased and pseudonymized successfully.' }); } catch (error) { console.error('DSAR Erasure Failed:', error); return res.status(500).json({ error: 'Internal failure during DSAR erasure processing' }); } }); module.exports = router; ``` --- ## 4. Anti-Patterns & Critical Pitfalls | Anti-Pattern | Severity | Consequence | Correct Pattern | |---|---|---|---| | Plaintext PII in application log files | Critical | GDPR fine up to 4% global turnover / $20M | Mask emails (`j***e@domain.com`), IP addresses, and tokens in loggers | | Soft deleting rows while keeping PII in backup DBs | High | Non-compliance during privacy audit | Crypto-shred user KMS key so historical backups remain unreadable | | Missing Opt-Out mechanisms for CCPA ("Do Not Sell") | High | CCPA/CPRA enforcement penalties | Provide explicit API endpoint & frontend button for data sharing opt-out | | Storing user consent in local un-audited state | Medium | Unable to demonstrate legal compliance proof | Persist immutable consent log (`user_id`, `version`, `timestamp`, `ip`) | | Broad wildcard SELECT queries returning PII to telemetry | Medium | Unintentional PII leakage to third-party analytics | Explicitly exclude PII columns in reporting queries | --- ## 5. Privacy Compliance Verification Checklist - [ ] **Data Mapping Inventory**: Maintain updated Data Flow Diagram (DFD) and Record of Processing Activities (ROPA). - [ ] **Consent CMP Integration**: Confirm cookie categories (Necessary, Analytics, Marketing) block tags before user opt-in. - [ ] **Log Scrubbing Validation**: Grep production logs for email regex patterns to verify zero plaintext PII leaks. - [ ] **DSAR SLA Monitoring**: Automated alerts ensuring all access/erasure requests complete within **30 days**.