GDPR Engineering Readiness Checklist

Data minimization

Every personal-data field is traceable to a feature that actually needs it
Retention periods are a deliberate decision for each data store, not an accident of never deleting anything
Input collection, persistence, propagation, and retention have each been reviewed separately for new features touching personal data

A canonical subject identifier is propagated across every system that stores personal data
A deletion workflow fans out to replicas, search/cache, logs, analytics, and backups — not a single query against the primary database
Backup retention is bounded, or there's a defined process for applying pending deletions if a backup is ever restored
Anonymization is used where hard deletion would break referential integrity a downstream system depends on
Every third-party subprocessor holding personal data has its own confirmed deletion path

Exports use a structured, machine-readable format (JSON or CSV), not a PDF or rendered webpage
Exports use a stable, documented schema, not a raw dump of internal database structures
The export path is automated, not a manual one-off pull that won't scale past a handful of requests

Consent is recorded as structured, timestamped, purpose-specific data — not a single boolean flag with no history
Withdrawing consent actually stops the associated processing, not just flips a flag nothing else checks
Consent state is checked at the point processing happens, not only at the point data was originally collected

A data-flow map covers every system touching personal data, not just the primary database
Regions are deliberately pinned for services handling personal data, not left at whatever a cloud provider defaults to
Personal data is encrypted in transit and at rest, including backups and derived stores like search indexes or caches
Access to personal-data stores follows least privilege and is logged, rather than broad standing production access for convenience

New subprocessors are evaluated for deletion/export support, region, and their own subprocessor chain before adoption, not after
Privacy-relevant questions are part of design and code review for changes touching personal data, not a one-time audit event
A qualified legal review has assessed whether your actual processing activities, legal basis, and contracts satisfy GDPR — this checklist covers engineering practices only, not a compliance determination