name: gdpr-basic
description: GDPR Basic Compliance Guidelines
category: security
rules:
  - "Collect explicit, informed, and freely given consent before processing personal data — pre-checked boxes are not valid consent"
  - "Practice data minimization — only collect and retain personal data that is strictly necessary for the stated purpose"
  - "Implement right to deletion (right to be forgotten) — users must be able to request complete removal of their personal data"
  - "Implement data portability — provide users a machine-readable export (JSON/CSV) of all their personal data on request"
  - "Implement right of access — users must be able to view all personal data you hold about them within 30 days of request"
  - "Apply privacy by design — build data protection into system architecture from the start, not as an afterthought"
  - "Maintain a Record of Processing Activities (ROPA) documenting what data you collect, why, and how long you keep it"
  - "Implement breach notification — report personal data breaches to the supervisory authority within 72 hours of discovery"
  - "Obtain explicit consent before setting non-essential cookies or tracking — implement a compliant cookie consent banner"
  - "Do not transfer personal data outside the EEA without appropriate safeguards (SCCs, adequacy decisions, or BCRs)"
  - "Define and enforce data retention periods — automatically delete or anonymize personal data when the retention period expires"
  - "Implement granular consent management — users must be able to withdraw consent as easily as they gave it"
  - "Conduct Data Protection Impact Assessments (DPIA) before processing that is likely to result in high risk to individuals"
  - "Pseudonymize personal data wherever possible — separate identifying information from the data being processed"
  - "Never use personal data for purposes beyond what was explicitly communicated at the time of collection without new consent"