compliance-awareness

Compliance Awareness

Disclaimer: This skill provides practical engineering patterns for compliance. It is not legal advice. Consult legal counsel for your specific compliance obligations.

Core Principle

Compliance is a set of engineering constraints, not a checkbox exercise. Build compliance into the system architecture from day one. Retrofitting compliance is 10x harder and 10x more expensive than building it in.

1. Data Classification Levels

Every field your system stores must be classified. The classification determines how the data is stored, accessed, logged, and deleted.

Implementing Data Classification

// Tag every database field with its classification
// This drives encryption, access control, and logging behavior

interface FieldClassification {
  field: string;
  classification: 'public' | 'internal' | 'confidential' | 'restricted';
  regulations: string[];         // ['gdpr', 'hipaa', 'pci-dss']
  retentionDays: number;         // How long to keep before purging
  piiType?: string;              // 'name' | 'email' | 'ssn' | 'health_record'
}

const userTableClassification: FieldClassification[] = [
  { field: 'id', classification: 'internal', regulations: [], retentionDays: -1 },
  { field: 'email', classification: 'confidential', regulations: ['gdpr'], retentionDays: 365, piiType: 'email' },
  { field: 'name', classification: 'confidential', regulations: ['gdpr'], retentionDays: 365, piiType: 'name' },
  { field: 'password_hash', classification: 'restricted', regulations: [], retentionDays: -1 },
  { field: 'ssn', classification: 'restricted', regulations: ['gdpr'], retentionDays: 90, piiType: 'ssn' },
  { field: 'health_notes', classification: 'restricted', regulations: ['hipaa', 'gdpr'], retentionDays: 2555, piiType: 'health_record' },
];