gdpr-compliant

# GDPR Engineering Skill Actionable GDPR reference for engineers, architects, DevOps, and tech leads. Inspired by CNIL developer guidance and GDPR Articles 5, 25, 32, 33, 35. > **Golden Rule:** Collect less. Store less. Expose less. Retain less. For deep dives, read the reference files in `references/`: - `references/data-rights.md` — user rights endpoints, DSR workflow, RoPA - `references/security.md` — encryption, hashing, secrets, anonymization - `references/operations.md` — cloud, CI/CD, incident response, architecture patterns --- ## 1. Core GDPR Principles (Article 5) | Principle | Engineering obligation | |---|---| | Lawfulness, fairness, transparency | Document legal basis for every processing activity in the RoPA | | Purpose limitation | Data collected for purpose A **MUST NOT** be reused for purpose B without a new legal basis | | Data minimization | Collect only fields with a documented business need today | | Accuracy | Provide update endpoints; propagate corrections to downstream stores | | Storage limitation | Define TTL at schema design time — never after | | Integrity & confidentiality | Encrypt at rest and in transit; restrict and audit access | | Accountability | Maintain evidence of compliance; RoPA ready for DPA inspection at any time | --- ## 2. Privacy by Design & by Default **MUST** - Add `CreatedAt`, `RetentionExpiresAt` to every table holding personal data at creation time. - Default all optional data collection to **off**. Users opt in; they...