vibecosystem

GDPR Compliance

Data Subject Rights

Rights Overview

| Right | Article | SLA | Implementation | |-------|---------|-----|----------------| | Right of Access | Art. 15 | 30 gun | Data export endpoint | | Right to Rectification | Art. 16 | 30 gun | Profile edit + audit trail | | Right to Erasure | Art. 17 | 30 gun | Cascading delete + anonymize | | Right to Restriction | Art. 18 | 30 gun | Processing flag on record | | Right to Portability | Art. 20 | 30 gun | Machine-readable export (JSON/CSV) | | Right to Object | Art. 21 | 30 gun | Opt-out mechanism | | Automated Decision-Making | Art. 22 | 30 gun | Human review override |

Data Subject Request Handler

interface DSRRequest {
  id: string;
  type: 'access' | 'rectification' | 'erasure' | 'restriction' | 'portability' | 'objection';
  subjectId: string;
  verifiedIdentity: boolean;
  receivedAt: Date;
  deadline: Date;  // receivedAt + 30 gun
  status: 'received' | 'verified' | 'processing' | 'completed' | 'rejected';
  reason?: string;
}

async function handleDSR(request: DSRRequest): Promise<DSRResponse> {
  // Step 1: Identity verification ZORUNLU
  if (!request.verifiedIdentity) {
    return { status: 'rejected', reason: 'Identity not verified' };
  }

  // Step 2: Check deadline
  const daysRemaining = differenceInDays(request.deadline, new Date());
  if (daysRemaining <= 5) {
    await alertDPO({ type: 'dsr_deadline_approaching', request });
  }

  // Step 3: Process by type
  switch (request.type) {
    case 'access':
      return await generateDataExport(request.subjectId);
    case 'erasure':
      return await executeErasure(request.subjectId);
    case 'portability':
      return await generatePortableExport(request.subjectId, 'json');
    case 'rectification':
      return await updateSubjectData(request.subjectId, request.corrections);
    case 'restriction':
      return await restrictProcessing(request.subjectId);
    case 'objection':
      return await recordObjection(request.subjectId, request.reason);
  }
}

Right to Erasure Implementation

async function executeErasure(subjectId: string): Promise<ErasureResult> {
  const erasureLog: ErasureStep[] = [];

  await db.transaction(async (tx) => {
    // 1. Anonymize user record (yasal zorunluluklar haric)
    await tx.users.update({
      where: { id: subjectId },
      data: {
        email: `erased-${hash(subjectId)}@deleted.local`,
        name: 'Erased User',
        phone: null,
        address: null,
        dateOfBirth: null,
        deletedAt: new Date(),
      },
    });
    erasureLog.push({ table: 'users', action: 'anonymized' });

    // 2. Delete personal messages
    const deletedMessages = await tx.messages.deleteMany({
      where: { userId: subjectId },
    });
    erasureLog.push({ table: 'messages', action: 'deleted', count: deletedMessages.count });

    // 3. Delete sessions and tokens
    await tx.sessions.deleteMany({ where: { userId: subjectId } });
    await tx.refreshTokens.deleteMany({ where: { userId: subjectId } });
    erasureLog.push({ table: 'sessions', action: 'deleted' });

    // 4. Anonymize audit logs (log kaydi kalir, kisi bilgisi gider)
    await tx.auditLogs.updateMany({
      where: { actorId: subjectId },
      data: { actorId: 'erased', actorEmail: 'erased' },
    });
    erasureLog.push({ table: 'auditLogs', action: 'anonymized' });

    // 5. Notify third-party processors
    await notifyProcessors(subjectId, 'erasure');

    // 6. Record erasure for compliance
    await tx.erasureRecords.create({
      data: {
        subjectHash: hash(subjectId),
        erasedAt: new Date(),
        systems: erasureLog,
      },
    });
  });

  return { success: true, steps: erasureLog };
}

Lawful Basis for Processing

| Basis | Article | When to Use | Example | |-------|---------|-------------|---------| | Consent | Art. 6(1)(a) | Optional processing, marketing | Newsletter signup | | Contract | Art. 6(1)(b) | Necessary for service delivery | Order processing | | Legal obligation | Art. 6(1)(c) | Required by law | Tax records | | Vital interests | Art. 6(1)(d) | Life-threatening situations | Emergency contact | | Public interest | Art. 6(1)(e) | Public authority tasks | Government services | | Legitimate interest | Art. 6(1)(f) | Business need, balanced with rights | Fraud prevention |

Lawful Basis Checklist

• [ ] Documented lawful basis for EACH processing activity
• [ ] Records of Processing Activities (RoPA) maintained
• [ ] Legitimate Interest Assessment (LIA) for Art. 6(1)(f)
• [ ] Special category data has Art. 9 basis
• [ ] Children's data has parental consent (Art. 8)

Data Protection Impact Assessment (DPIA)

When Required (Art. 35)

• Automated decision-making with legal effects
• Large-scale processing of sensitive data
• Systematic monitoring of public areas
• New technology with high privacy risk
• Large-scale profiling

DPIA Template

## Data Protection Impact Assessment

**Project:** [proje adi]
**Date:** [tarih]
**DPO Review:** [evet/hayir]

### 1. Processing Description
- What data: [veri turleri]
- Why: [amac]
- How: [islem yontemi]
- Who: [erisim kimlerde]
- How long: [saklama suresi]

### 2. Necessity & Proportionality
- Lawful basis: [hukuki dayanak]
- Data minimization: [minimum veri mi?]
- Purpose limitation: [amac sinirli mi?]
- Storage limitation: [saklama suresi uygun mu?]

### 3. Risk Assessment
| Risk | Likelihood | Impact | Severity | Mitigation |
|------|-----------|--------|----------|------------|
| Unauthorized access | [L/M/H] | [L/M/H] | [L/M/H] | [onlem] |
| Data breach | [L/M/H] | [L/M/H] | [L/M/H] | [onlem] |
| Purpose creep | [L/M/H] | [L/M/H] | [L/M/H] | [onlem] |

### 4. Measures
- [ ] Encryption at rest and in transit
- [ ] Access controls (RBAC)
- [ ] Audit logging
- [ ] Data minimization applied
- [ ] Retention policy configured
- [ ] Pseudonymization where possible

### 5. DPO Sign-off
Date: [tarih] | Approved: [evet/hayir]

Privacy by Design Patterns

Data Minimization

// YANLIS: Tum veriyi topla
const user = await db.users.findUnique({
  where: { id },
  // Returns everything including SSN, DOB, etc.
});

// DOGRU: Sadece gerekli alanlari sec
const user = await db.users.findUnique({
  where: { id },
  select: {
    id: true,
    name: true,
    email: true,
    // SSN, DOB, etc. secilmez
  },
});

PII Masking

function maskPII(data: Record<string, unknown>): Record<string, unknown> {
  const piiFields: Record<string, (val: string) => string> = {
    email: (v) => v.replace(/^(.{2}).*(@.*)$/, '$1***$2'),
    phone: (v) => v.replace(/^(.{3}).*(.{2})$/, '$1*****$2'),
    ssn: (v) => `***-**-${v.slice(-4)}`,
    creditCard: (v) => `****-****-****-${v.slice(-4)}`,
    ip: (v) => v.replace(/\.\d+$/, '.xxx'),
    name: (v) => `${v.charAt(0)}${'*'.repeat(v.length - 1)}`,
  };

  return Object.fromEntries(
    Object.entries(data).map(([key, value]) => {
      const masker = piiFields[key];
      if (masker && typeof value === 'string') {
        return [key, masker(value)];
      }
      return [key, value];
    })
  );
}

Encryption at Rest

import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';

const ALGORITHM = 'aes-256-gcm';

function encryptPII(plaintext: string, key: Buffer): EncryptedData {
  const iv = randomBytes(16);
  const cipher = createCipheriv(ALGORITHM, key, iv);
  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
  const authTag = cipher.getAuthTag();

  return {
    ciphertext: encrypted.toString('base64'),
    iv: iv.toString('base64'),
    authTag: authTag.toString('base64'),
  };
}

fun