GDPR
General Data Protection Regulation
General Data Protection Regulation, Regulation (EU) 2016/679. EU law on processing personal data: Article 25 requires data protection by design and by default, Article 32 requires security appropriate to the risk, and Article 33 requires notifying the supervisory authority of a personal data breach within 72 hours where feasible.
Covered in
GDPR, CCPA, HIPAA or the FTC rule: scope privacy and health-data obligations before choosing controls
Map data, actors and processing purposes to the relevant GDPR, California or HIPAA requirements and preserve uncertainty about applicability.
GDPR privacy by design for engineers: Articles 25, 32 and 35 in code
Turn GDPR data protection by design and by default, security of processing and DPIA triggers into engineering work: a personal-data inventory checked in CI, defaults that collect and share less, a DPIA screen at design time, and access and erasure requests that reach every store.