gdpr-data-handling

Store each consent decision with purpose, timestamp, policy version, IP address, and user agent, and maintain an audit log of grants and withdrawals. Provide an opt-in banner where analytics and marketing checkboxes are unchecked by default and necessary cookies cannot be disabled.

Create a DSAR handler that records the request with a 30-day deadline, collects user data from every connected data source, and returns a structured response including data categories, retention info, processing purposes, and third-party recipients.

Special category data such as health, religion, and ethnicity requires explicit consent under Article 9, while criminal conviction data under Article 10 requires official authority. Children's data under age 16 requires parental consent.

Supervisory authorities must be notified within 72 hours when a breach involves sensitive data types like health, financial, credentials, or biometric data, or when severity is medium or higher. Affected individuals must be notified for high and critical severity breaches.

Retention periods depend on the legal basis: transaction records may be kept seven years for tax obligations, marketing consent data around two years, and analytics data one year before anonymization. Each data type needs a documented retention policy with a defined trigger date.