When this skill is activated, always start your first response with the 🧢 emoji.
Privacy Compliance
Disclaimer: This skill provides engineering and product implementation
guidance only. It is not legal advice. Consult qualified legal counsel for
compliance decisions specific to your organization, jurisdiction, and use case.
A practical framework for engineers and product teams building privacy-compliant systems. Covers GDPR, CCPA, consent management, data subject rights, DPIAs, and cross-border transfer mechanisms - with emphasis on what to build and how to structure it, not just regulatory theory.
When to use this skill
Trigger this skill when the user:
- Asks how to implement GDPR or CCPA compliance for a product
- Needs to design a cookie banner, consent manager, or preference center
- Wants to conduct or template a Data Protection Impact Assessment (DPIA)
- Needs to handle a Subject Access Request (SAR), deletion, or portability request
- Is writing or reviewing a privacy policy
- Needs to implement data retention or deletion schedules
- Is configuring cross-border data transfers (SCCs, adequacy decisions)
Do NOT trigger this skill for:
- General security hardening unrelated to personal data (use the backend-engineering skill)
- IP law, contracts, or employment law - these require specialized legal counsel
Key principles
- Privacy by design - Build privacy controls into the architecture from day
one. Data minimization, access controls, and audit logs are structural decisions, not features added after launch. Retrofitting is expensive and incomplete.
- Data minimization - Collect only what you need, retain it only as long as
necessary, and delete it on schedule. Every field in your database is a liability if you cannot justify its purpose and retention period.
- Lawful basis for processing - Every processing activity must have a documented
lawful basis (GDPR) or a disclosure obligation (CCPA). "We might need it someday" is not a lawful basis. Document the basis before you collect the data.
- Transparency - Users must understand what data you collect, why, how long you
keep it, and who you share it with. Privacy policies must be readable, not a legal wall. Consent must be informed to be valid.
- Accountability - Maintain records of processing activities (RoPA), run DPIAs
for high-risk processing, appoint a DPO when required, and respond to data subject requests within statutory deadlines. Compliance is a continuous process, not a one-time audit.
Core concepts
GDPR vs CCPA at a glance
| Dimension | GDPR (EU/EEA) | CCPA / CPRA (California) | |---|---|---| | Scope | Any org processing EU/EEA residents' data | Businesses meeting revenue/data thresholds serving CA residents | | Legal basis required | Yes - 6 lawful bases | No explicit basis required; disclosure + opt-out | | Consent standard | Freely given, specific, informed, unambiguous, withdrawable | Opt-out for sale/sharing; opt-in for sensitive data (CPRA) | | Data subject rights | Access, rectification, erasure, portability, restriction, objection, no automated decision | Know, delete, correct, opt-out of sale/sharing, limit sensitive data use, non-discrimination | | Response deadline | 30 days (extendable to 90 days) | 45 days (extendable to 90 days) | | Breach notification | 72 hours to supervisory authority; notify individuals if high risk | Reasonable time; private right of action for breaches | | Penalties | Up to 4% global annual turnover or €20M | Up to $7,500 per intentional violation | | DPO required | For large-scale systematic processing or sensitive data | No equivalent role required | | Cross-border transfers | SCCs, adequacy decisions, BCRs required | No equivalent mechanism required |
Lawful bases for processing (GDPR Art. 6)
| Basis | When to use | Gotcha | |---|---|---| | Consent | Marketing, non-essential cookies, optional features | Must be withdrawable; withdrawal must be as easy as giving it | | Contract | Processing necessary to fulfill a contract with the user | Can only cover what is genuinely necessary for the contract | | Legal obligation | Tax records, fraud reporting mandated by law | Must be a specific law, not a vague compliance claim | | Vital interests | Emergency medical situations | Rarely applicable outside health contexts | | Public task | Government and public authority processing | Not applicable to most private organizations | | Legitimate interests (LI) | Analytics, fraud prevention, direct marketing (with caveats) | Must pass LI Assessment (LIA) - user interests must not override yours |
Data subject rights
| Right | GDPR | CCPA/CPRA | Implementation note | |---|---|---|---| | Right to know / access | Art. 15 | Yes | Export all personal data in a portable format | | Right to rectification / correction | Art. 16 | CPRA only | Update incorrect data across all systems | | Right to erasure ("right to be forgotten") | Art. 17 | Yes | Cascade deletes across primary store, replicas, backups, third-party processors | | Right to portability | Art. 20 | Yes (categories + specific pieces) | Machine-readable format (JSON, CSV) | | Right to restriction of processing | Art. 18 | No | Freeze processing while dispute is resolved | | Right to object | Art. 21 | Opt-out of sale/sharing | Especially for direct marketing and LI-based processing | | No automated decision-making | Art. 22 | No | Human review option for decisions with legal/significant effects |
Cross-border transfer mechanisms
| Mechanism | Use when | |---|---| | Adequacy decision | Transferring to a country the EU Commission has approved (e.g., UK post-IDTA, Japan, Canada) | | Standard Contractual Clauses (SCCs) | Most common for transfers to non-adequate countries (e.g., US). Use 2021 SCCs. | | Binding Corporate Rules (BCRs) | Intra-group transfers within a large multinational; requires DPA approval, lengthy process | | Derogations (Art. 49) | Narrow exceptions: explicit consent, performance of contract, vital interests. Not for systematic transfers. |
Common tasks
1. Implement a GDPR compliance checklist
Use this as a product/engineering launch gate:
Data inventory
- [ ] Record of Processing Activities (RoPA) created and up to date
- [ ] Lawful basis documented for each processing activity
- [ ] Retention periods defined for each data category
- [ ] Third-party processors identified; DPAs signed with each
Technical controls
- [ ] Personal data encrypted at rest and in transit
- [ ] Access to personal data is role-based and audited
- [ ] Pseudonymization applied where full identification is not needed
- [ ] Automated deletion jobs scheduled per retention policy
User-facing obligations
- [ ] Privacy policy published, accessible, and up to date
- [ ] Cookie consent mechanism in place (see task 2)
- [ ] Data subject request workflow implemented (see task 4)
- [ ] Age verification where required (special categories, children's data)
Organizational
- [ ] DPO appointed (if required) and contact details published
- [ ] Data breach response procedure documented and tested
- [ ] DPIA completed for high-risk processing activities (see task 3)
- [ ] Staff privacy training completed
2. Design consent management (cookie banners and preference center)
The consent bar is higher than most implementations meet. For GDPR, pre-ticked boxes, bundled consent, and making "reject" harder than "accept" are all invalid.
Cookie categories to surface to users:
| Category | Examples | Requires consent? | |---|---|---| | Strictly necessary | Session auth, load balancing, CSRF tokens | No - but must disclose | | Functional / preferences | Language, theme, remembered settings | Yes (GDPR), disclose (CCPA) | | Analytics / performance | Google Analytics, Heap, session recording | Yes (GDPR), opt-out (CCPA) | | Marketing / advertising | Ad pix