Compliance: GDPR deep dive
This course covers what a Rails team builds once GDPR applies to its app. It starts with the six lawful bases and why the basis is chosen before collection. It treats data subject rights as workflows with a one-month deadline and identity verification. It follows erasure beyond the users table into backups, logs and vendors, comparing soft delete, hard delete and crypto-shredding. It also covers minimisation and retention in migrations, processors and international transfers, and the 72-hour breach notification clock. None of it is legal advice.
What you'll learn
- ✓Choosing one of the six lawful bases before collecting data, and why consent is the weakest
- ✓Building access, restriction, portability and other rights as workflows with a one-month deadline
- ✓Reaching erasure beyond the database with soft delete, hard delete, crypto-shredding and anonymisation
- ✓Enforcing minimisation, purpose limitation and retention in migrations and scheduled jobs
- ✓Tracking processors and subprocessors with DPAs and transfer mechanisms for data leaving the EU
- ✓Preparing for the 72-hour breach notification clock before an incident starts
Picking up where the overview left off
The senior course "Compliance: the regulatory landscape" told you GDPR is Regulation (EU) 2016/679, applicable since 25 May 2018. It told you the trigger is the data subject's location and the market you offer into, and not your company's address. It told you the distinction between controller and…
Read the full lesson free →Curriculum
7 lessonsPicking up where the overview left off
Frames GDPR compliance as running systems engineers build, and separates legal calls from engineering work.
Lawful basis, chosen before the first row
Covers the six lawful bases, the limits of consent and legitimate interest, and choosing the basis before collection.
Data subject rights as workflows, not checkboxes
Turns access, rectification, erasure, restriction, portability and objection into workflows with a one-month deadline and identity checks.
Erasure at scale
Follows personal data into backups, logs and vendors, and compares soft delete, hard delete, crypto-shredding and anonymisation.
Minimisation, purpose limitation and retention in the schema
Treats minimisation, purpose limitation and retention as decisions made in migrations, comments and scheduled jobs.
Processors, subprocessors, and crossing a border
Explains data processing agreements, subprocessor registers, and the legal mechanisms needed when personal data leaves the EU.
The 72-hour clock
Explains when the 72-hour breach notification clock starts, who must be told, and what must exist beforehand.