## Lawful Basis & Transparency
- [ ] Document lawful basis for each processing activity
- [ ] Maintain records of processing activities (Article 30)
- [ ] Privacy policy is clear, accessible, updated

## Data Security
- [ ] Encryption at rest and in transit
- [ ] Pseudonymization where possible
- [ ] Data Protection Impact Assessment (DPIA) for high-risk processing
- [ ] Breach notification process (72 hours to authority)

## Governance
- [ ] Data Protection Officer (DPO) appointed if required
- [ ] Data Processing Agreements with third parties
- [ ] EU representative appointed (if outside EU)

## Individual Rights
- [ ] Process to handle access requests
- [ ] Process to handle deletion requests
- [ ] Process to handle data portability requests
- [ ] Consent mechanism (opt-in, not opt-out)

// ❌ BAD
logger.info(`User ${user.email} logged in from ${user.ipAddress}`);

// ✅ GOOD
logger.info(`User ${hashUserId(user.id)} logged in`);

// Encrypt before storing
const encryptedEmail = encrypt(user.email, encryptionKey);
await db.users.update({ id: user.id, email: encryptedEmail });

// Decrypt only when needed
const email = decrypt(storedUser.email, encryptionKey);

// ❌ BAD - Fetching everything
const user = await db.users.findById(id);
return user; // Contains PII you don't need

// ✅ GOOD - Select only needed fields
const user = await db.users.findById(id, {
  select: ['id', 'displayName', 'preferences']
});
return user;

interface ConsentRecord {
  userId: string;
  purpose: 'marketing' | 'analytics' | 'personalization';
  granted: boolean;
  timestamp: Date;
  source: 'web' | 'mobile' | 'api';
  version: string; // Privacy policy version
}

// Always check consent before processing
async function canProcess(userId: string, purpose: string): Promise<boolean> {
  const consent = await getLatestConsent(userId, purpose);
  return consent?.granted === true;
}

interface DataSubjectRequest {
  type: 'access' | 'rectification' | 'erasure' | 'portability' | 'objection';
  userId: string;
  requestedAt: Date;
  deadline: Date; // 30 days for GDPR
  status: 'pending' | 'processing' | 'completed' | 'denied';
}

// Implement audit trail for all requests
async function handleDSR(request: DataSubjectRequest) {
  await auditLog.record({
    action: 'dsr_received',
    requestType: request.type,
    userId: request.userId,
    timestamp: new Date()
  });

  // Process based on type...
}

// Replace direct identifiers with tokens
function pseudonymize(record: UserRecord): PseudonymizedRecord {
  return {
    pseudoId: generateToken(record.id), // Reversible with key
    ageGroup: getAgeGroup(record.birthDate), // 18-25, 26-35, etc.
    region: record.country, // Keep general location
    // Omit: name, email, exact address, etc.
  };
}

## Privacy Impact Assessment
- [ ] What PII will be collected?
- [ ] What is the lawful basis (GDPR) / primary purpose (APP)?
- [ ] Is all collected data necessary? (data minimization)
- [ ] How long will data be retained?
- [ ] Who will have access?
- [ ] Will data cross borders?
- [ ] What security measures are in place?

## Technical Implementation
- [ ] PII encrypted at rest
- [ ] PII encrypted in transit (TLS 1.2+)
- [ ] Logging excludes PII
- [ ] Consent captured before processing
- [ ] Data subject request endpoints implemented
- [ ] Retention/deletion automation in place
- [ ] Audit logging for PII access