privacy-compliance

Privacy and Compliance Engineering

Almost every product processes personal data — an email address is personal data. The engineering obligations that follow are concrete, buildable, and far cheaper to build in than to retrofit.

Scope note. This skill produces the technical controls and a policy drafted from real data flows. It is not legal advice. For a regulated sector, a high-risk processing activity, or a live regulatory enquiry, the recommendation is to have a qualified privacy lawyer review the output. Say this plainly to the user; do not let it stop you from building the controls, which are the same either way.

---

The order of work

Every artefact depends on the one above it. Drafting a privacy policy before the inventory means describing a system you have not read.

1. DATA INVENTORY   →  what is actually collected, from the code
2. POLICY           →  a document generated from that inventory
3. CONSENT          →  a mechanism that genuinely gates the scripts
4. RIGHTS PIPELINE  →  export and deletion, automated end to end
5. GOVERNANCE       →  DPAs, retention, breach plan, ongoing review

---

1. Build the data inventory from the code

Never from a form, an interview, or a template. From the schema, the routes and the third-party integrations. What a team believes it collects and what it collects are routinely different.

# Personal data in the schema
grep -rEni '(email|phone|address|birth|dob|ssn|passport|ip_?addr|location|lat|lng|gender|name)' \
  --include='*.prisma' --include='*.sql' --include='models*.py' --include='schema.rb' . | head -40

# Every third party that receives data — SDKs, tags, pixels, fonts, embeds
grep -rhoE 'googletagmanager|google-analytics|gtag\(|connect\.facebook\.net|hotjar|segment|mixpanel|posthog|intercom|clarity\.ms|sentry\.io|stripe|paypal|fonts\.googleapis|recaptcha|youtube\.com/embed|player\.vimeo|cdn\.jsdelivr' \
  . --exclude-dir={node_modules,.git,dist} | sort -u

# Where data enters
grep -rEn 'req\.body|request\.form|@RequestBody|params\.permit' --exclude-dir=node_modules . | head -30