The cheapest data to protect is the data you never collected
Every field you store is a field you must secure, back up, replicate, explain, export on request and delete on request. "We might need it later" is how a shop ends up holding dates of birth it has never used and cannot now justify.
Ask three questions before adding a column: what decision does this let us make, how long is it useful for, and what happens if it leaks.
The words that appear in every regulation
GDPR is the strictest widely-applicable version and is a reasonable default even where it does not apply. This is not legal advice; it is the engineering shape the law expects.
| Principle | In practice |
|---|---|
| Lawful basis | you need a reason: a contract, consent, or a legitimate interest you wrote down |
| Minimisation | collect the fields the purpose needs, and no others |
| Purpose limitation | data collected to ship an order is not marketing data |
| Storage limitation | a retention period per kind of data, enforced by a job |
| Access and portability | they can ask for a copy, in a usable format |
| Erasure | they can ask you to delete it — with exceptions you can name |
| Breach notification | a regulator in 72 hours, and the people affected without undue delay |
Deletion is harder than it sounds
- Backups. You cannot rewrite a snapshot. The accepted approach is a documented policy: deletions are applied to live systems immediately and to backups as they expire.
- Derived data. Analytics, search indexes, a cache, a data warehouse, the CRM, the mail provider. Deletion has to fan out to every copy you created.
- Logs. See the last lesson: if the personal data never went into them, this problem does not exist.
- Legal holds. An invoice usually must be kept for years — so "delete my account" means anonymise the customer and keep the financial record, and you should be able to explain exactly that.
Pseudonymisation, and what it does not do
const pseudo = hmac(key, email); // stable, so the same person groups together
// reversible only with the key, which lives elsewhereThe set of email addresses is small enough to brute-force: anyone with your table and a word list recovers most of them. That is why a keyed hash matters, and why pseudonymised data is still personal data under the law. Anonymous means nobody can get back — usually aggregation, not hashing.
Third parties are your problem too
An analytics script, a session recorder, a chat widget, a font served from someone else's domain: each one sees your users and receives their IP address. You are responsible for that, both legally and practically — a compromised widget is XSS on your page, as the dependencies lesson said.
Keep the list short, know what each one collects, and self-host what you can. A font file is 30 KB and removes an entire third party from the conversation.