GDPR Compliance Checker

-- Check for unencrypted personal data
SELECT table_name, column_name, data_type
FROM information_schema.columns 
WHERE column_name LIKE '%email%' 
   OR column_name LIKE '%phone%'
   OR column_name LIKE '%address%'
   OR column_name LIKE '%name%';

-- Audit data retention periods
SELECT table_name, 
       COUNT(*) as total_records,
       MIN(created_at) as oldest_record,
       MAX(created_at) as newest_record
FROM user_data 
GROUP BY table_name;

# GDPR-compliant data collection
class UserConsentManager:
    def collect_data(self, user_data, consent_purposes):
        # Verify explicit consent for each purpose
        for purpose in consent_purposes:
            if not self.has_valid_consent(user_data['user_id'], purpose):
                raise ConsentRequiredException(f"Missing consent for: {purpose}")

        # Log processing activity (Article 30)
        self.log_processing_activity(
            purpose=consent_purposes,
            legal_basis="consent",
            data_categories=self.categorize_data(user_data),
            retention_period=self.get_retention_period(purpose)
        )

        return self.process_data(user_data)

    def handle_data_subject_request(self, request_type, user_id):
        """Handle Article 15-22 data subject rights"""
        if request_type == "access":  # Article 15
            return self.export_user_data(user_id)
        elif request_type == "rectification":  # Article 16
            return self.update_user_data(user_id)
        elif request_type == "erasure":  # Article 17 (Right to be forgotten)
            return self.delete_user_data(user_id)
        elif request_type == "portability":  # Article 20
            return self.export_portable_data(user_id)

# Required Privacy Policy Elements Checklist:

□ Identity and contact details of controller (Article 13.1a)
□ Contact details of Data Protection Officer if applicable
□ Purposes and legal basis for processing (Article 13.1c)
□ Legitimate interests if applicable (Article 13.1d)
□ Categories of recipients (Article 13.1e)
□ International transfer details (Article 13.1f)
□ Retention periods or criteria (Article 13.2a)
□ Data subject rights explanation (Article 13.2b)
□ Right to withdraw consent (Article 13.2c)
□ Right to lodge complaint with supervisory authority
□ Whether provision is statutory/contractual requirement
□ Automated decision-making/profiling information

dpia_assessment:
  processing_description:
    purpose: "Detailed description of processing purpose"
    data_categories: ["personal", "special_category", "criminal"]
    subjects: ["employees", "customers", "children"]
    recipients: ["internal_teams", "processors", "third_countries"]

  necessity_proportionality:
    lawful_basis: "Article 6 basis"
    special_category_basis: "Article 9 basis if applicable"
    necessity_justification: "Why processing is necessary"
    proportionality_assessment: "Balancing test results"

  risk_assessment:
    likelihood: ["remote", "possible", "likely"]
    severity: ["minimal", "limited", "significant", "severe"]
    risk_level: "calculated_risk_score"

  safeguards:
    technical_measures: ["encryption", "access_controls", "anonymization"]
    organisational_measures: ["training", "policies", "audit_procedures"]

# Data encryption at rest and in transit
import cryptography.fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC

class GDPRDataEncryption:
    def __init__(self, password: bytes):
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=b'stable_salt_for_gdpr',  # Use random salt in production
            iterations=100000,
        )
        key = base64.urlsafe_b64encode(kdf.derive(password))
        self.cipher = Fernet(key)

    def encrypt_personal_data(self, data: str) -> str:
        """Encrypt personal data before storage"""
        return self.cipher.encrypt(data.encode()).decode()

    def decrypt_personal_data(self, encrypted_data: str) -> str:
        """Decrypt for legitimate access"""
        return self.cipher.decrypt(encrypted_data.encode()).decode()

class ProcessingActivityLogger:
    def log_activity(self, activity_data):
        """Article 30 - Records of processing activities"""
        record = {
            'timestamp': datetime.utcnow(),
            'controller': activity_data['controller'],
            'purpose': activity_data['purpose'],
            'legal_basis': activity_data['legal_basis'],
            'data_categories': activity_data['data_categories'],
            'subject_categories': activity_data['subject_categories'],
            'recipients': activity_data.get('recipients', []),
            'third_country_transfers': activity_data.get('transfers', []),
            'retention_schedule': activity_data['retention'],
            'security_measures': activity_data['security_measures']
        }

        # Store in tamper-proof audit log
        self.audit_store.create_record(record)

□ Current SCC version implemented (2021 SCCs)
□ Appropriate SCC module selected (C2C, C2P, P2P, P2C)
□ Local law impact assessment completed
□ Additional safeguards implemented if required
□ Regular review mechanism established
□ Suspension/termination procedures defined