GDPR Engineering: Translating Article 32 to Code

Lawyers write the policies, but engineers build the safeguards. Here is how to implement the General Data Protection Regulation.

The Core Engineering Mandates

Article 32 of the GDPR states you must implement "appropriate technical and organisational measures." In engineering terms, this means encryption, access control, and auditability. The EDPB (European Data Protection Board) issued fines totaling €2.1 billion in 2023 for failures in these exact areas.

GDPR ArticleLegal RequirementEngineering Implementation
Art 17Right to ErasureHard-deletes via database cron jobs. No soft-delete tombstones.
Art 20Data PortabilityAsync worker queues generating JSON/CSV exports via API.
Art 25Privacy by DesignDefaulting boolean columns like `marketing_opt_in` to `false`.
Art 32Security of ProcessingTLS 1.3 in transit, AES-GCM at rest, stringent RBAC.

Tool: Data Minimization Checker

A core tenet of GDPR is collecting only what is strictly necessary. Analyze your database schema against minimization rules.

Common Mistakes: The "Consent" Fallacy

Relying solely on consent is a failure mode. Consent can be withdrawn. Engineers should build systems utilizing "Legitimate Interest" or "Contractual Necessity" where applicable. If you base core functionality on consent, a user revoking it means you must dynamically tear down their data access without breaking relational integrity.

FAQ

Does hashing a user ID make it anonymous?
No. Hashing (e.g., SHA-256) is pseudonymization, not anonymization. It is still subject to GDPR because a rainbow table or salt key can reverse it.
Where should we store our database backups?
Within the EU, ideally. If transferring to the US, you must implement SCCs (Standard Contractual Clauses) and supplementary measures per Schrems II.

Explore Architecture Requirements