Skip to content

GDPR & Privacy-by-Design Technical Standards#

Target Context: Database schemas, ORM models, Data Transfer Objects (DTOs).

  1. Pseudonymization: Primary keys identifying users MUST be random UUIDv4, not sequential integers or emails.
  2. Right to be Forgotten: All user-associated records must support a cascading hard delete OR an anonymization script capability.
  3. Field-Level Encryption: Fields named ssn, credit_card, health_data, or dob must utilize AES-256-GCM encryption at the application layer before persistence.
  4. Data Minimization: Do not add columns for demographic data unless explicitly required by the Jira ticket.