Implement GDPR Data Handling Practices

GDPR Data Handling is a practical implementation guide for GDPR-compliant data processing, consent management, and privacy controls. It defines the four personal data categories with their protection levels (basic data like name, email, and phone at standard protection; sensitive Art. 9 data like health, religion, and ethnicity requiring explicit consent; criminal Art. 10 data requiring official authority; and children's data under 16 requiring parental consent), the six Article 6 lawful bases for processing (consent, contract, legal obligation, vital interests, public interest, legitimate interest), and the six data subject rights (access, rectification, erasure, restriction, portability, and objection), all of which must be responded to within one month. It packages five implementation patterns with working code: a consent management data model and ConsentManager service that records granular per-purpose consent with timestamp, IP address, and user-agent proof, plus a sample GDPR-compliant cookie consent banner; a Data Subject Access Request (DSAR) handler covering access, erasure, and portability requests with a 30-day response deadline and a 60-day extension for complex requests; a data retention policy engine with per-data-type retention periods, legal bases, and anonymize-versus-delete behavior; a privacy-by-design data model separating PII, encrypted at rest, from pseudonymized behavioral analytics, plus a data minimization helper that filters form fields to only what a given purpose requires; and a breach notification handler that classifies severity, escalates to the DPO and security team, and schedules the 72-hour supervisory-authority notification required for sensitive data types, escalating to direct notification of affected individuals when severity is high or critical. Do's-and-don'ts best practices call for opt-in consent that is never pre-checked and never bundled across purposes, and for cross-border transfers to use a safeguard such as Standard Contractual Clauses or an adequacy decision. It closes with a GDPR implementation checklist covering legal basis, transparency, data subject rights, security, breach response, and documentation.

Use it when building systems that process EU personal data, implementing consent management, handling data subject requests, conducting GDPR compliance reviews, designing privacy-first architectures, or creating data processing agreements. Do not use it when the task is unrelated to GDPR data handling or needs a different domain or tool outside this scope.

Inputs are the personal data categories being processed, their legal basis, and any data subject request submitted (access, erasure, rectification, or portability). Outputs are working code patterns: consent records with audit logs, DSAR responses including a machine-readable JSON export for portability requests, enforced retention and anonymization actions, privacy-by-design schemas, and structured breach reports for regulators covering affected data categories, measures taken, and measures proposed.

Code samples are JavaScript/Node (consent schema and manager, HTML consent banner) and Python (DSAR handler, retention policy engine, privacy-by-design models, breach notification handler), reading from and writing to a document database, and touch a geoip2 database lookup for generalizing IP addresses to country level.

Engineers and compliance teams building or auditing systems that process EU personal data, implementing consent flows, or standing up data subject request and breach notification processes.