GDPR Compliance Implementation

When to use

• Implementing Subject Access Requests (SAR) and right to erasure
• Designing consent management systems
• Setting up data retention and automatic deletion
• Planning 72-hour breach notification workflow
• Choosing lawful basis for data processing

Core principles

1. Privacy by design — build privacy in from the start; retrofitting is 10x harder
2. Data minimization — collect only what you need for the stated purpose
3. 72 hours for breach notification — to supervisory authority; 30 days for SAR response
4. Consent must be specific and withdrawable — "I agree to terms" does not cover marketing emails
5. Document the lawful basis — legitimate interest requires a balancing test; consent is not always the right choice

References available

• references/data-mapping.md — retention schedules, lawful basis matrix, data flow mapping, PII inventory
• references/consent-management.md — consent record schema, grant/withdraw patterns, audit trail requirements
• references/dsar-procedures.md — SAR workflow (30-day), right to erasure with financial compliance exceptions, breach notification steps

Assets available

• assets/dpia-template.md — Data Protection Impact Assessment template for high-risk processing