We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design and AI Engineering, by Roni Das. 984 interactive lessons.
Start LearningIntermediate · Data Governance & Compliance
General Data Protection Regulation: EU law governing how personal data is collected, stored, and processed. Requires consent, data portability, and the right to be forgotten.
In short
GDPR (General Data Protection Regulation) is a European Union law, in force since May 25, 2018, that governs how organizations collect, store, and process the personal data of people in the EU and EEA. It applies to any company anywhere in the world that handles that data, requires a lawful basis such as consent to process it, gives people rights like access, portability, and erasure, and allows fines up to 20 million euros or 4 percent of global annual revenue, whichever is higher.
In short
GDPR (General Data Protection Regulation) is a European Union law, in force since May 25, 2018, that governs how organizations collect, store, and process the personal data of people in the EU and EEA. It applies to any company anywhere in the world that handles that data, requires a lawful basis such as consent to process it, gives people rights like access, portability, and erasure, and allows fines up to 20 million euros or 4 percent of global annual revenue, whichever is higher.
Learn it in the course
This page is the free part.
₹1,111 in India$25 everywhere elseonce, for the whole course
The System Design course covers GDPR across a run of lessons, not one page. These 4 alone are about 116 minutes of step-by-step reading, every one with a quiz.
The engineer's guide to GDPR: understand the regulation that changed how every tech company handles personal data.
What data pseudonymization is, how it differs from anonymization under GDPR, keyed hashing vs tokens, and what Google Cloud, AWS, Azure and NetSuite offer.
Define how long data is kept, when it's archived, and when it's deleted, balancing compliance, cost, and utility.
Protect personal information by design, privacy isn't a feature you add later, it's an architecture decision.
all part of
System Design Masterclass
770 lessons · about 287 hours · 18 free to read
₹1,111in India, by UPI
$25everywhere else, by PayPal
It is really nice and good Please join the course
You own this course
Continue with GDPR Compliancepay once,
yours for life
GDPR is Regulation 2016/679, a single law that replaced a patchwork of national rules across the 27 EU member states plus the EEA countries (Iceland, Liechtenstein, Norway). Because it is a regulation and not a directive, it applies directly in every member state without each country writing its own version.
It covers personal data, which is any information that can identify a living person: a name, email, IP address, device ID, location, or even a cookie identifier. A subset called special category data (health, biometrics, race, religion, political views, sexual orientation) gets stricter protection.
The reach is extraterritorial. If you are a startup in India or the US and you offer goods or services to people in the EU, or you track their behavior, GDPR applies to you. This is why a small SaaS company in Bangalore still ends up writing a privacy policy that talks about EU data subject rights.
Every act of processing personal data needs a lawful basis. There are six: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Consent is the one most people know, but it is often the weakest choice because it has to be freely given, specific, informed, and as easy to withdraw as to give. A pre-ticked checkbox is not valid consent.
GDPR splits responsibility between the controller (the company that decides why and how data is processed) and the processor (a vendor that processes data on the controller's behalf, like AWS or a payment provider). The two sign a Data Processing Agreement that spells out obligations. A controller stays liable even when a processor causes the breach.
It grants individuals concrete rights: access (get a copy of their data), rectification (fix errors), erasure (the right to be forgotten), portability (export data in a machine-readable format like JSON or CSV), and the right to object. Most requests must be answered within one month, free of charge.
Two engineering principles are baked in. Data protection by design means privacy is a default in the system, not bolted on later. Data minimization means you only collect what you actually need. If a data breach happens, the controller must notify the supervisory authority within 72 hours of becoming aware of it.
GDPR matters the moment you store anything that points back to a real EU person. For most web and mobile products that is the default situation, so the practical question is not whether it applies but how much engineering it forces.
The cost is real. You need consent management for cookies, audit logs of what data you hold and why, deletion pipelines that can fully erase a user across your primary database, backups, analytics, and third-party tools, and a way to export a user's data on demand. Cross-border transfers out of the EU need a legal mechanism such as Standard Contractual Clauses, which got more complex after the Schrems II ruling invalidated the Privacy Shield in 2020.
The trade-off is between data utility and legal risk. Hoarding data for some future machine learning use is exactly what GDPR discourages, and storing special category data raises your exposure sharply. Teams that treat compliance as a design constraint early (clear schemas, soft-delete plus hard-delete jobs, regional data residency) pay far less than teams that retrofit it after a regulator asks questions.
Enforcement is not theoretical. Fines come in two tiers, up to 10 million euros or 2 percent of global turnover for lesser violations, and up to 20 million euros or 4 percent for serious ones. Regulators have issued billions in penalties since 2018.
In 2023 the Irish Data Protection Commission fined Meta 1.2 billion euros, the largest GDPR fine to date, for transferring European Facebook user data to US servers without adequate protection against US surveillance laws. That single ruling forced Meta to rethink where EU data physically lives.
On a smaller scale, picture a typical product flow. A user in Germany signs up. Your cookie banner records their consent choice with a timestamp and stores it. Their profile, activity logs, and analytics events all carry a user ID. Months later they email a deletion request. Your system has one month to run a job that removes their row from Postgres, purges their events from your analytics warehouse, tells your email provider and payment processor to delete their records, and confirms back to the user.
If you cannot do that cleanly because the user ID is smeared across logs, caches, and a data lake with no deletion path, you have a GDPR problem long before any regulator calls. This is why GDPR is as much a data architecture topic as a legal one.
Meta (Facebook)
Fined 1.2 billion euros in 2023 for transferring EU user data to US servers without adequate safeguards, the largest GDPR penalty so far.
Amazon Web Services
Offers EU regions like Frankfurt and Dublin plus Data Processing Addendums so customers can keep EU data resident and meet controller-processor obligations.
Was fined 50 million euros by France's CNIL in 2019 for unclear consent and insufficient transparency in its ad personalization.
Cloudflare
Provides EU data localization and regional services so traffic and logs for EU users can be processed inside the EU.
Yes. If you offer goods or services to people in the EU or EEA, or you monitor their behavior, GDPR applies no matter where your company is based. A US or Indian startup with EU users must comply.
The controller decides why and how personal data is processed and is the one ultimately responsible. The processor handles the data on the controller's instructions, like a cloud host or analytics vendor. They sign a Data Processing Agreement, and the controller stays liable even for the processor's mistakes.
It is the right to erasure under Article 17. A person can ask you to delete their personal data, and unless you have a legal reason to keep it you must remove it across your systems, usually within one month. In practice that means a deletion pipeline that reaches your database, backups, analytics, and third-party tools.
Up to 10 million euros or 2 percent of global annual revenue for lesser violations, and up to 20 million euros or 4 percent for serious ones, whichever figure is higher. Meta's 1.2 billion euro fine in 2023 is the record so far.
No. Consent is only one of six lawful bases. You can also rely on performing a contract, a legal obligation, vital interests, a public task, or legitimate interests. Consent is often the hardest to rely on because it must be freely given and easy to withdraw.
Data Pseudonymization
What data pseudonymization is, how it differs from anonymization under GDPR, keyed hashing vs tokens, and what Google Cloud, AWS, Azure and NetSuite offer.
Data Retention Policies
Define how long data is kept, when it's archived, and when it's deleted, balancing compliance, cost, and utility
Data Privacy
Protect personal information by design, privacy isn't a feature you add later, it's an architecture decision
Data Anonymization
Data anonymization compared: k-anonymity, l-diversity and differential privacy. Includes a hashing test that shows why hashed IDs can be reversed.
Geo-Replication
Replicate data to geographically distributed nodes for compliance, performance, and resilience
PII
Personally Identifiable Information: any data that can identify a specific individual, like name, email, SSN, or IP address. Must be encrypted and access-controlled.
Data Encryption
Transforming data into an unreadable format using cryptographic algorithms. Encryption at rest protects stored data; encryption in transit protects data over the network.
Data Lineage
Tracking data from its origin through every transformation and system it passes through. Answers 'where did this number come from?' for audits and debugging.
Data Catalog
A searchable inventory of all datasets in an organization, with metadata like schema, owner, freshness, and lineage. The 'Google for your data.'
Data Masking
Replacing sensitive data with realistic but fake values so developers and testers can work with production-like data without exposing real PII.
This page explains the idea. The "GDPR Compliance" lesson builds it up step by step, with diagrams. It is part of the System Design Masterclass course, which has 770 lessons. 18 of them are free to read. You pay once and keep it for life, with no subscription.
Open the GDPR Compliance lessoncourse 1
From absolute beginner to principal engineer, drawn step by step.
Asked about GDPR in an interview?
Each question has why it is asked, a full answer, what the interviewer listens for, the follow-ups, the common mistakes and a diagram (268 diagrams in all). A PDF you keep, junior to staff level.
India: UPI, cards or netbanking through Razorpay. Elsewhere: card or PayPal. Download at once from My packs.
