Systems Analyst: How do you design for data privacy (GDPR, CCPA)?

Data privacy — protecting personal data and ensuring compliance.

Key regulations:

• GDPR (EU): Consent, right to erasure, data portability.
• CCPA (California): Opt-out of sale, right to know.
• HIPAA (US healthcare): PHI protection.

Privacy by design principles:

1. Proactive not reactive.
2. Privacy as default.
3. Privacy embedded into design.
4. Full functionality (positive-sum).
5. End-to-end security.
6. Visibility and transparency.
7. Respect for user privacy.

Implementation:

• Data classification: Tag PII, sensitive data.
• Consent management: Track user consent per purpose.
• Right to erasure: Implement deletion across all systems.
• Data minimization: Collect only needed data.
• Encryption: At rest and in transit.
• Access control: Least privilege, audit logging.

Technical measures:

• Anonymization, pseudonymization.
• Data masking in non-production.
• Retention automation.

Tools:

• OneTrust, TrustArc, BigID.