Privacy & Compliance (GDPR, CCPA, HIPAA)
The main data privacy regulations, what rights they grant to individuals, and what technical obligations they create for your systems.
Privacy regulations give individuals rights over their data: you can ask a company what they have on you, correct it, delete it, take it elsewhere. Companies must deliver these rights on demand — usually within 30 days.
The big three: **** (EU, strict, penalties up to 4% of global revenue), **CCPA/CPRA** (California, similar spirit, more permissive), **** (US, health-specific — any org handling US medical data). Others to know: **LGPD** (Brazil, GDPR-inspired), **PIPEDA** (Canada), **APPI** (Japan), **PDPA** (Singapore).
Key GDPR concepts: **** (anything identifying a person — name, email, IP, cookie, location, device ID), **Lawful basis** (you need a legal reason to process: consent, contract, legal obligation, vital interests, public interest, legitimate interests), **Data subject rights** (access, rectification, erasure, portability, objection, restriction), **** (Data Protection Impact Assessment — required for high-risk processing), **DPO** (Data Protection Officer — mandatory role for some orgs).
Practical consequences for systems: (a) **map personal data** — you must know every place it lives; (b) **delete on request** — including backups and ML models where feasible; (c) **log consent** — prove when/how/for what; (d) **notify breaches** within 72h; (e) **cross-border transfers** — EU data can only leave the EU under specific conditions (SCCs, adequacy decisions).
Penalties are real. GDPR fines have hit €746M (Amazon), €405M (Instagram/Meta). For small companies, the risk is less the fine and more reputational: losing customer trust after a public breach is very expensive.
Grounded on https://gdpr.eu/
Next up
Access Control — RBAC & ABAC
Who can access what data, under what conditions. RBAC (by role) is simple but rigid; ABAC (by attributes) is flexible but complex. Most orgs use both.