gdpr-technical-controlslisted

# GDPR — Technical Controls GDPR (and its UK / EEA siblings) is a legal framework with a heavy technical surface. This skill stays on the engineering side: what to build, what to log, what to expose, what to delete. For DACH-specific Impressum/AGB/AVV requirements, see [`dach-compliance`](../dach-compliance/SKILL.md). For data-protection legal questions, talk to a DPO. The terms used here line up with the regulation but are paraphrased. When in doubt, the regulation text is the source of truth. ## When to invoke - Building or reviewing a product handling EU/EEA/UK resident data - Responding to a Subject Access Request (SAR) or deletion request - Preparing for a Datenschutz / DPA audit - Adding a new third-party processor (analytics, support, email, AI, CDN) - After a suspected personal-data breach - A user asked "where is my data?" ## Step 1 — Data inventory You cannot protect data you cannot enumerate. Build and maintain a record of: - **What personal data fields** you store (`users.email`, `orders.shipping_address.street`, …) - **Where** each lives (Postgres table, S3 bucket, log file, third-party processor) - **Purpose** of each (legal basis: consent / contract / legitimate interest / legal obligation) - **Retention period** — when it should be deleted - **Who can access** it (roles, audit log) - **Third parties (processors)** receiving copies, and the lawful basis for each transfer A reasonable starting format: ``` Field | Location