DEV Community

Thesius Code
Thesius Code

Posted on • Originally published at datanest-stores.pages.dev

GDPR Privacy Toolkit

#security #cybersecurity #devsecops #cloud

GDPR Privacy Toolkit

A comprehensive, implementation-ready toolkit for building GDPR-compliant data processing systems from scratch. Instead of vague legal checklists, this package delivers concrete data mapping templates, Data Protection Impact Assessment (DPIA) frameworks, consent management code patterns, and fully scripted data subject request (DSR) handling workflows — the engineering side of privacy compliance that most guides skip entirely.

Key Features

  • Data Mapping Generator — Python scripts that crawl your database schemas and produce Article 30-compliant Records of Processing Activities (ROPA) in structured YAML.
  • DPIA Framework — Step-by-step impact assessment templates with risk scoring matrices, covering high-risk processing scenarios like profiling, large-scale monitoring, and automated decision-making.
  • Consent Management Patterns — Backend code for granular consent collection, storage, withdrawal, and audit trails.
  • Data Subject Request Automation — Scripts for handling access (Art. 15), erasure (Art. 17), portability (Art. 20), and objection (Art. 21) within the 30-day deadline.
  • Retention Policy Engine — Configurable data retention scheduler with automatic purge logging and legal hold overrides.
  • Breach Notification Templates — Pre-drafted notifications for supervisory authorities (72-hour window) and affected data subjects.

Quick Start 

# Extract and configure
unzip gdpr-privacy-toolkit.zip
cd gdpr-privacy-toolkit/

# Generate a data mapping from your database schema
python3 scripts/data_mapper.py --db-schema schema.sql --output data_map.yaml

# Run a DPIA for a specific processing activity
cp templates/dpia_template.yaml my_dpia.yaml
# Edit my_dpia.yaml with your processing details, then score it:
python3 scripts/dpia_scorer.py --input my_dpia.yaml
Enter fullscreen mode Exit fullscreen mode

Consent Record Schema 

import json
import time
import uuid
from dataclasses import dataclass, field

@dataclass
class ConsentRecord:
    """GDPR-compliant consent record with full audit trail."""

    subject_id: str
    purpose: str
    legal_basis: str  # "consent", "contract", "legal_obligation", etc.
    granted: bool
    timestamp: float = field(default_factory=time.time)
    consent_id: str = field(default_factory=lambda: str(uuid.uuid4()))
    source: str = "web_form"
    version: str = "1.0"
    withdrawn: bool = False
    withdrawn_at: float | None = None

    def withdraw(self) -> None:
        self.withdrawn = True
        self.withdrawn_at = time.time()

    def is_valid(self) -> bool:
        return self.granted and not self.withdrawn
Enter fullscreen mode Exit fullscreen mode

Architecture / How It Works 

Data Subject ──► Consent Collection ──► Consent Store (DB)
                                              │
                 ┌────────────────────────────┤
                 ▼                            ▼
          DSR Handler                  Retention Engine
          (access/erase/port)          (schedule/purge/log)
                 │                            │
                 ▼                            ▼
          Response Builder             Purge Audit Log
          (JSON/PDF export)            (immutable record)
                 │
                 ▼
          Breach Notifications
          (72-hour templates)
Enter fullscreen mode Exit fullscreen mode

The toolkit treats privacy as a data pipeline: consent flows in, processing happens under documented legal bases, and subject rights flow back out — all with immutable audit logs.

Usage Examples

Data Subject Access Request Handler 

import json
from pathlib import Path

class DSRHandler:
    """Handle GDPR Data Subject Requests within the 30-day window."""

    def __init__(self, data_store_path: str):
        self.data_store = Path(data_store_path)

    def handle_access_request(self, subject_id: str) -> dict:
        """Article 15: Right of Access — export all data for a subject."""
        data: dict = {"subject_id": subject_id, "personal_data": {}}
        for f in self.data_store.glob(f"**/subject_{subject_id}*.json"):
            with open(f) as fh:
                data["personal_data"][f.stem] = json.load(fh)
        return data

    def handle_erasure_request(self, subject_id: str) -> dict:
        """Article 17: Right to Erasure (respecting legal holds)."""
        erased, retained = [], []
        for f in self.data_store.glob(f"**/subject_{subject_id}*.json"):
            if f.with_suffix(".hold").exists():
                retained.append(str(f))
            else:
                f.unlink()
                erased.append(str(f))
        return {"erased": erased, "retained_legal_hold": retained}
Enter fullscreen mode Exit fullscreen mode

Retention Policy Configuration 

retention_policies:
  transaction_records:
    retention_period_days: 2555  # ~7 years (tax law)
    legal_basis: "legal_obligation"
    purge_method: "secure_delete"

  marketing_consent:
    retention_period_days: 1095  # 3 years from last interaction
    legal_basis: "consent"
    purge_method: "anonymize"

  access_logs:
    retention_period_days: 90
    legal_basis: "legitimate_interest"
    purge_method: "delete"
Enter fullscreen mode Exit fullscreen mode

Configuration

Parameter Default Description
dsr.response_deadline_days 30 Max days to respond to a DSR
dsr.identity_verification two_factor Verification level before processing DSR
retention.default_period_days 365 Default retention if no specific policy
retention.purge_method anonymize delete, anonymize, or secure_delete
consent.require_double_optin true Require email confirmation for consent
breach.notification_window_hours 72 Supervisory authority notification deadline
audit.log_retention_days 2555 How long to keep audit logs (~7 years)

Best Practices

  1. Map before you build — Complete your ROPA data mapping before writing any consent management code. You cannot protect data you haven't inventoried.
  2. Separate consent per purpose — Bundled consent ("agree to everything") is not GDPR-compliant. Each processing purpose needs its own toggle.
  3. Log everything immutably — Consent grants, withdrawals, DSR processing, and purge operations must produce tamper-evident audit records.
  4. Test your erasure pipeline — Run erasure requests against test data monthly. Orphaned records in backup systems are a common audit finding.
  5. Automate the 30-day clock — DSR deadlines are strict. Use calendar integrations and escalation alerts to prevent breaches.
  6. Privacy by design, not by patch — Integrate these patterns into your CI/CD pipeline, not as a post-launch remediation project.

Troubleshooting

Problem Cause Fix
Data mapper misses tables Schema parser doesn't support your DDL dialect Export schema as standard SQL or provide a CSV column inventory
Erasure leaves orphan records Foreign key references in unmapped tables Run data_mapper.py with --deep-scan to find all references
DPIA score seems too low Risk matrix weights not calibrated for your industry Adjust risk_weights in dpia_config.yaml for your regulatory context
Consent records missing timestamps Clock not synchronized across services Ensure all services use NTP; store timestamps as UTC epoch

This is 1 of 9 resources in the Security Engineer Pro toolkit. Get the complete [GDPR Privacy Toolkit] with all files, templates, and documentation for $39.

Get the Full Kit →

Or grab the entire Security Engineer Pro bundle (9 products) for $119 — save 30%.

Get the Complete Bundle →

Related Articles

Top comments (0)