gdpr-data-handling

Store consent records with purpose, timestamp, policy version, IP address, and user agent, plus an audit log of grants and withdrawals. Emit consent change events so downstream systems can react, and always check the latest consent record before processing.

Verify the requester's identity, then collect their data from every connected data source and compile it into a structured response with retention info, processing purposes, and third-party recipients. You must respond within 30 days, with a possible 60-day extension for complex requests.

GDPR does not mandate fixed periods; you must define retention per data type based on its legal basis. Common examples include 7 years for transaction records under tax law, 2-3 years for account and support data, and anonymization for analytics data after one year.

Supervisory authorities must be notified within 72 hours when a breach risks individuals' rights, and always when sensitive data like health, financial, or credentials is involved. Affected individuals must be notified directly for high or critical severity breaches.

Consent must be freely given, specific, and withdrawable, so it fails when there is a power imbalance or when bundled across purposes. For essential processing, rely on contract or legal obligation bases instead, and never use pre-checked consent boxes.