1# gdpr-data-handling — detailed worked examples
2 
3## Implementation Patterns
4 
5### Pattern 1: Consent Management
6 
7```javascript
8// Consent data model
9const consentSchema = {
10  userId: String,
11  consents: [
12    {
13      purpose: String, // 'marketing', 'analytics', etc.
14      granted: Boolean,
15      timestamp: Date,
16      source: String, // 'web_form', 'api', etc.
17      version: String, // Privacy policy version
18      ipAddress: String, // For proof
19      userAgent: String, // For proof
20    },
21  ],
22  auditLog: [
23    {
24      action: String, // 'granted', 'withdrawn', 'updated'
25      purpose: String,
26      timestamp: Date,
27      source: String,
28    },
29  ],
30};
31 
32// Consent service
33class ConsentManager {
34  async recordConsent(userId, purpose, granted, metadata) {
35    const consent = {
36      purpose,
37      granted,
38      timestamp: new Date(),
39      source: metadata.source,
40      version: await this.getCurrentPolicyVersion(),
41      ipAddress: metadata.ipAddress,
42      userAgent: metadata.userAgent,
43    };
44 
45    // Store consent
46    await this.db.consents.updateOne(
47      { userId },
48      {
49        $push: {
50          consents: consent,
51          auditLog: {
52            action: granted ? "granted" : "withdrawn",
53            purpose,
54            timestamp: consent.timestamp,
55            source: metadata.source,
56          },
57        },
58      },
59      { upsert: true },
60    );
61 
62    // Emit event for downstream systems
63    await this.eventBus.emit("consent.changed", {
64      userId,
65      purpose,
66      granted,
67      timestamp: consent.timestamp,
68    });
69  }
70 
71  async hasConsent(userId, purpose) {
72    const record = await this.db.consents.findOne({ userId });
73    if (!record) return false;
74 
75    const latestConsent = record.consents
76      .filter((c) => c.purpose === purpose)
77      .sort((a, b) => b.timestamp - a.timestamp)[0];
78 
79    return latestConsent?.granted === true;
80  }
81 
82  async getConsentHistory(userId) {
83    const record = await this.db.consents.findOne({ userId });
84    return record?.auditLog || [];
85  }
86}
87```
88 
89```html
90<!-- GDPR-compliant consent UI -->
91<div class="consent-banner" role="dialog" aria-labelledby="consent-title">
92  <h2 id="consent-title">Cookie Preferences</h2>
93 
94  <p>
95    We use cookies to improve your experience. Select your preferences below.
96  </p>
97 
98  <form id="consent-form">
99    <!-- Necessary - always on, no consent needed -->
100    <div class="consent-category">
101      <input type="checkbox" id="necessary" checked disabled />
102      <label for="necessary">
103        <strong>Necessary</strong>
104        <span>Required for the website to function. Cannot be disabled.</span>
105      </label>
106    </div>
107 
108    <!-- Analytics - requires consent -->
109    <div class="consent-category">
110      <input type="checkbox" id="analytics" name="analytics" />
111      <label for="analytics">
112        <strong>Analytics</strong>
113        <span>Help us understand how you use our site.</span>
114      </label>
115    </div>
116 
117    <!-- Marketing - requires consent -->
118    <div class="consent-category">
119      <input type="checkbox" id="marketing" name="marketing" />
120      <label for="marketing">
121        <strong>Marketing</strong>
122        <span>Personalized ads based on your interests.</span>
123      </label>
124    </div>
125 
126    <div class="consent-actions">
127      <button type="button" id="accept-all">Accept All</button>
128      <button type="button" id="reject-all">Reject All</button>
129      <button type="submit">Save Preferences</button>
130    </div>
131 
132    <p class="consent-links">
133      <a href="/privacy-policy">Privacy Policy</a> |
134      <a href="/cookie-policy">Cookie Policy</a>
135    </p>
136  </form>
137</div>
138```
139 
140### Pattern 2: Data Subject Access Request (DSAR)
141 
142```python
143from datetime import datetime, timedelta
144from typing import Dict, List, Optional
145import json
146 
147class DSARHandler:
148    """Handle Data Subject Access Requests."""
149 
150    RESPONSE_DEADLINE_DAYS = 30
151    EXTENSION_ALLOWED_DAYS = 60  # For complex requests
152 
153    def __init__(self, data_sources: List['DataSource']):
154        self.data_sources = data_sources
155 
156    async def submit_request(
157        self,
158        request_type: str,  # 'access', 'erasure', 'rectification', 'portability'
159        user_id: str,
160        verified: bool,
161        details: Optional[Dict] = None
162    ) -> str:
163        """Submit a new DSAR."""
164        request = {
165            'id': self.generate_request_id(),
166            'type': request_type,
167            'user_id': user_id,
168            'status': 'pending_verification' if not verified else 'processing',
169            'submitted_at': datetime.utcnow(),
170            'deadline': datetime.utcnow() + timedelta(days=self.RESPONSE_DEADLINE_DAYS),
171            'details': details or {},
172            'audit_log': [{
173                'action': 'submitted',
174                'timestamp': datetime.utcnow(),
175                'details': 'Request received'
176            }]
177        }
178 
179        await self.db.dsar_requests.insert_one(request)
180        await self.notify_dpo(request)
181 
182        return request['id']
183 
184    async def process_access_request(self, request_id: str) -> Dict:
185        """Process a data access request."""
186        request = await self.get_request(request_id)
187 
188        if request['type'] != 'access':
189            raise ValueError("Not an access request")
190 
191        # Collect data from all sources
192        user_data = {}
193        for source in self.data_sources:
194            try:
195                data = await source.get_user_data(request['user_id'])
196                user_data[source.name] = data
197            except Exception as e:
198                user_data[source.name] = {'error': str(e)}
199 
200        # Format response
201        response = {
202            'request_id': request_id,
203            'generated_at': datetime.utcnow().isoformat(),
204            'data_categories': list(user_data.keys()),
205            'data': user_data,
206            'retention_info': await self.get_retention_info(),
207            'processing_purposes': await self.get_processing_purposes(),
208            'third_party_recipients': await self.get_recipients()
209        }
210 
211        # Update request status
212        await self.update_request(request_id, 'completed', response)
213 
214        return response
215 
216    async def process_erasure_request(self, request_id: str) -> Dict:
217        """Process a right to erasure request."""
218        request = await self.get_request(request_id)
219 
220        if request['type'] != 'erasure':
221            raise ValueError("Not an erasure request")
222 
223        results = {}
224        exceptions = []
225 
226        for source in self.data_sources:
227            try:
228                # Check for legal exceptions
229                can_delete, reason = await source.can_delete(request['user_id'])
230 
231                if can_delete:
232                    await source.delete_user_data(request['user_id'])
233                    results[source.name] = 'deleted'
234                else:
235                    exceptions.append({
236                        'source': source.name,
237                        'reason': reason  # e.g., 'legal retention requirement'
238                    })
239                    results[source.name] = f'retained: {reason}'
240            except Exception as e:
241                results[source.name] = f'error: {str(e)}'
242 
243        response = {
244            'request_id': request_id,
245            'completed_at': datetime.utcnow().isoformat(),
246            'results': results,
247            'exceptions': exceptions
248        }
249 
250        await self.update_request(request_id, 'completed', response)
251 
252        return response
253 
254    async def process_portability_request(self, request_id: str) -> bytes:
255        """Generate portable data export."""
256        request = await self.get_request(request_id)
257        user_data = await self.process_access_request(request_id)
258 
259        # Convert to machine-readable format (JSON)
260        portable_data = {
261            'export_date': datetime.utcnow().isoformat(),
262            'format_version': '1.0',
263            'data': user_data['data']
264        }
265 
266        return json.dumps(portable_data, indent=2, default=str).encode()
267```
268 
269### Pattern 3: Data Retention
270 
271```python
272from datetime import datetime, timedelta
273from enum import Enum
274 
275class RetentionBasis(Enum):
276    CONSENT = "consent"
277    CONTRACT = "contract"
278    LEGAL_OBLIGATION = "legal_obligation"
279    LEGITIMATE_INTEREST = "legitimate_interest"
280 
281class DataRetentionPolicy:
282    """Define and enforce data retention policies."""
283 
284    POLICIES = {
285        'user_account': {
286            'retention_period_days': 365 * 3,  # 3 years after last activity
287            'basis': RetentionBasis.CONTRACT,
288            'trigger': 'last_activity_date',
289            'archive_before_delete': True
290        },
291        'transaction_records': {
292            'retention_period_days': 365 * 7,  # 7 years for tax
293            'basis': RetentionBasis.LEGAL_OBLIGATION,
294            'trigger': 'transaction_date',
295            'archive_before_delete': True,
296            'legal_reference': 'Tax regulations require 7 year retention'
297        },
298        'marketing_consent': {
299            'retention_period_days': 365 * 2,  # 2 years
300            'basis': RetentionBasis.CONSENT,
301            'trigger': 'consent_date',
302            'archive_before_delete': False
303        },
304        'support_tickets': {
305            'retention_period_days': 365 * 2,
306            'basis': RetentionBasis.LEGITIMATE_INTEREST,
307            'trigger': 'ticket_closed_date',
308            'archive_before_delete': True
309        },
310        'analytics_data': {
311            'retention_period_days': 365,  # 1 year
312            'basis': RetentionBasis.CONSENT,
313            'trigger': 'collection_date',
314            'archive_before_delete': False,
315            'anonymize_instead': True
316        }
317    }
318 
319    async def apply_retention_policies(self):
320        """Run retention policy enforcement."""
321        for data_type, policy in self.POLICIES.items():
322            cutoff_date = datetime.utcnow() - timedelta(
323                days=policy['retention_period_days']
324            )
325 
326            if policy.get('anonymize_instead'):
327                await self.anonymize_old_data(data_type, cutoff_date)
328            else:
329                if policy.get('archive_before_delete'):
330                    await self.archive_data(data_type, cutoff_date)
331                await self.delete_old_data(data_type, cutoff_date)
332 
333            await self.log_retention_action(data_type, cutoff_date)
334 
335    async def anonymize_old_data(self, data_type: str, before_date: datetime):
336        """Anonymize data instead of deleting."""
337        # Example: Replace identifying fields with hashes
338        if data_type == 'analytics_data':
339            await self.db.analytics.update_many(
340                {'collection_date': {'$lt': before_date}},
341                {'$set': {
342                    'user_id': None,
343                    'ip_address': None,
344                    'device_id': None,
345                    'anonymized': True,
346                    'anonymized_date': datetime.utcnow()
347                }}
348            )
349```
350 
351### Pattern 4: Privacy by Design
352 
353```python
354class PrivacyFirstDataModel:
355    """Example of privacy-by-design data model."""
356 
357    # Separate PII from behavioral data
358    user_profile_schema = {
359        'user_id': str,  # UUID, not sequential
360        'email_hash': str,  # Hashed for lookups
361        'created_at': datetime,
362        # Minimal data collection
363        'preferences': {
364            'language': str,
365            'timezone': str
366        }
367    }
368 
369    # Encrypted at rest
370    user_pii_schema = {
371        'user_id': str,
372        'email': str,  # Encrypted
373        'name': str,   # Encrypted
374        'phone': str,  # Encrypted (optional)
375        'address': dict,  # Encrypted (optional)
376        'encryption_key_id': str
377    }
378 
379    # Pseudonymized behavioral data
380    analytics_schema = {
381        'session_id': str,  # Not linked to user_id
382        'pseudonym_id': str,  # Rotating pseudonym
383        'events': list,
384        'device_category': str,  # Generalized, not specific
385        'country': str,  # Not city-level
386    }
387 
388class DataMinimization:
389    """Implement data minimization principles."""
390 
391    @staticmethod
392    def collect_only_needed(form_data: dict, purpose: str) -> dict:
393        """Filter form data to only fields needed for purpose."""
394        REQUIRED_FIELDS = {
395            'account_creation': ['email', 'password'],
396            'newsletter': ['email'],
397            'purchase': ['email', 'name', 'address', 'payment'],
398            'support': ['email', 'message']
399        }
400 
401        allowed = REQUIRED_FIELDS.get(purpose, [])
402        return {k: v for k, v in form_data.items() if k in allowed}
403 
404    @staticmethod
405    def generalize_location(ip_address: str) -> str:
406        """Generalize IP to country level only."""
407        import geoip2.database
408        reader = geoip2.database.Reader('GeoLite2-Country.mmdb')
409        try:
410            response = reader.country(ip_address)
411            return response.country.iso_code
412        except:
413            return 'UNKNOWN'
414```
415 
416### Pattern 5: Breach Notification
417 
418```python
419from datetime import datetime
420from enum import Enum
421 
422class BreachSeverity(Enum):
423    LOW = "low"
424    MEDIUM = "medium"
425    HIGH = "high"
426    CRITICAL = "critical"
427 
428class BreachNotificationHandler:
429    """Handle GDPR breach notification requirements."""
430 
431    AUTHORITY_NOTIFICATION_HOURS = 72
432    AFFECTED_NOTIFICATION_REQUIRED_SEVERITY = BreachSeverity.HIGH
433 
434    async def report_breach(
435        self,
436        description: str,
437        data_types: List[str],
438        affected_count: int,
439        severity: BreachSeverity
440    ) -> dict:
441        """Report and handle a data breach."""
442        breach = {
443            'id': self.generate_breach_id(),
444            'reported_at': datetime.utcnow(),
445            'description': description,
446            'data_types_affected': data_types,
447            'affected_individuals_count': affected_count,
448            'severity': severity.value,
449            'status': 'investigating',
450            'timeline': [{
451                'event': 'breach_reported',
452                'timestamp': datetime.utcnow(),
453                'details': description
454            }]
455        }
456 
457        await self.db.breaches.insert_one(breach)
458 
459        # Immediate notifications
460        await self.notify_dpo(breach)
461        await self.notify_security_team(breach)
462 
463        # Authority notification required within 72 hours
464        if self.requires_authority_notification(severity, data_types):
465            breach['authority_notification_deadline'] = (
466                datetime.utcnow() + timedelta(hours=self.AUTHORITY_NOTIFICATION_HOURS)
467            )
468            await self.schedule_authority_notification(breach)
469 
470        # Affected individuals notification
471        if severity.value in [BreachSeverity.HIGH.value, BreachSeverity.CRITICAL.value]:
472            await self.schedule_individual_notifications(breach)
473 
474        return breach
475 
476    def requires_authority_notification(
477        self,
478        severity: BreachSeverity,
479        data_types: List[str]
480    ) -> bool:
481        """Determine if supervisory authority must be notified."""
482        # Always notify for sensitive data
483        sensitive_types = ['health', 'financial', 'credentials', 'biometric']
484        if any(t in sensitive_types for t in data_types):
485            return True
486 
487        # Notify for medium+ severity
488        return severity in [BreachSeverity.MEDIUM, BreachSeverity.HIGH, BreachSeverity.CRITICAL]
489 
490    async def generate_authority_report(self, breach_id: str) -> dict:
491        """Generate report for supervisory authority."""
492        breach = await self.get_breach(breach_id)
493 
494        return {
495            'organization': {
496                'name': self.config.org_name,
497                'contact': self.config.dpo_contact,
498                'registration': self.config.registration_number
499            },
500            'breach': {
501                'nature': breach['description'],
502                'categories_affected': breach['data_types_affected'],
503                'approximate_number_affected': breach['affected_individuals_count'],
504                'likely_consequences': self.assess_consequences(breach),
505                'measures_taken': await self.get_remediation_measures(breach_id),
506                'measures_proposed': await self.get_proposed_measures(breach_id)
507            },
508            'timeline': breach['timeline'],
509            'submitted_at': datetime.utcnow().isoformat()
510        }
511```
512 
513## Compliance Checklist
514 
515```markdown
516## GDPR Implementation Checklist
517 
518### Legal Basis
519 
520- [ ] Documented legal basis for each processing activity
521- [ ] Consent mechanisms meet GDPR requirements
522- [ ] Legitimate interest assessments completed
523 
524### Transparency
525 
526- [ ] Privacy policy is clear and accessible
527- [ ] Processing purposes clearly stated
528- [ ] Data retention periods documented
529 
530### Data Subject Rights
531 
532- [ ] Access request process implemented
533- [ ] Erasure request process implemented
534- [ ] Portability export available
535- [ ] Rectification process available
536- [ ] Response within 30-day deadline
537 
538### Security
539 
540- [ ] Encryption at rest implemented
541- [ ] Encryption in transit (TLS)
542- [ ] Access controls in place
543- [ ] Audit logging enabled
544 
545### Breach Response
546 
547- [ ] Breach detection mechanisms
548- [ ] 72-hour notification process
549- [ ] Breach documentation system
550 
551### Documentation
552 
553- [ ] Records of processing activities (Art. 30)
554- [ ] Data protection impact assessments
555- [ ] Data processing agreements with vendors
556```
557