Privacy and data governance

Privacy and data governance treat personal and sensitive data as a **lifecycle problem**: classify, minimize, consent, protect, retain, audit, delete, and govern third-party sharing. Compliance (GDPR, CCPA, sector rules) is easier when systems encode purpose limitation and observability early—not as a post-launch checkbox.

| Principle | Engineering manifestation | |-----------|---------------------------| | Classification | Tags on fields/tables; separate PII stores where needed | | Minimization | Collect only fields required for the stated purpose | | Consent & purpose | Explicit records; feature flags tied to consent state | | Access control | RBAC/ABAC, break-glass with audit | | Retention | TTL jobs, legal holds, automated deletion workflows | | Portability & erasure | Subject requests propagate to caches, backups, vendors | | Vendor risk | DPAs, subprocessors, data residency, breach notification |

					Data map: source → lawful basis → storage → processors → retention → deletion
Every new field: "Do we need it? Who can read it? How is it erased?"
				

Encryption: TLS in transit; field- or envelope-level encryption for highly sensitive attributes; keys in KMS/HSM—not in app config. Logging must redact or tokenize identifiers by default.

On interviews: design a newsletter signup with optional profile enrichment. Cover consent text, double opt-in where required, unsubscribe propagation, analytics without re-identification, and vendor subprocessors.

Common pitfalls: logging full payloads; "delete user" that leaves analytics rows; sharing production dumps with AI tools; ambiguous lawful basis; backups that never expire.

The trade-off is product analytics richness versus privacy risk and operational cost of deletion and access reviews.

Checklist:

• Data inventory for new features.
• Default-deny access to PII.
• Deletion and export runbooks tested.
• Third-party flows documented and reviewed.