General Data Protection Regulation
The GDPR applies to processing of personal data of people in the EU. For engineering teams it translates into data protection by design and by default, documented lawful bases and well-built data subject rights.
Example finding{
"rule": "gdpr.consent-and",
"framework": "GDPR",
"severity": "high",
"file": "app/api/signup.ts",
"check": "Consent and lawful-basis records",
"status": "failed",
"fix": { "available": true, "files": 2 }
}What GDPR expects from engineering.
- 01
Lawful basis
Every processing activity needs a lawful basis such as consent, contract or legitimate interest.
- 02
Privacy by design
Build data minimisation, pseudonymisation and access limits into systems by default (Art. 25).
- 03
Data subject rights
Support access, rectification, erasure, portability, restriction and objection requests.
- 04
Security of processing
Apply appropriate technical measures such as encryption and access control (Art. 32).
- 05
Breach notification
Notify the supervisory authority within 72 hours where a breach poses a risk (Art. 33).
- 06
International transfers
Use an adequacy decision or appropriate safeguards for transfers outside the EEA.
Turned into code rules.
- Consent and lawful-basis records
- Data export (portability) endpoints
- Right-to-erasure flows across services
- Encryption of personal data at rest
- Region pinning for data stores
Read the source.
RuleFix links to primary sources so you can check the requirements yourself. We are not affiliated with these bodies.
Cover more with the same workflow.
DPDP
HIPAA
LGPD
Ship AI-powered products
that are compliant by design.
Join developers building with RuleFix.