GDPR Data Portability, DPO and Breach Notification: Engineering Guide

This guide maps Matrix controls Data Portability (gdpr-3, Article 20), Data Protection Officer (gdpr-4, Article 37), and Breach Notification (gdpr-5, Article 33) to engineering work. It is not legal advice; use qualified counsel to assess applicability and notification content.

1. Data portability: build an export boundary (gdpr-3)

Use an explicit export schema rather than serializing database rows. This prevents internal-only fields, credentials, and other users’ data entering a dossier.

const exportProfile = ({ id, email, createdAt }: User) => ({
  schemaVersion: 1, subjectId: id, contact: { email }, accountCreatedAt: createdAt.toISOString(),
});

export async function buildPortabilityExport(subjectId: string) {
  const [user, events] = await Promise.all([getUser(subjectId), getSubjectEvents(subjectId)]);
  if (!user) throw new Error('Subject not found');
  return { exportedAt: new Date().toISOString(), profile: exportProfile(user), events };
}

Test authorisation, tenant isolation, schema versioning, completion status, and deletion of temporary export artifacts. Article 20 is the legal source; it does not prescribe this JSON shape.

2. DPO operations: make the route auditable (gdpr-4)

Article 37 applies in specified circumstances, including certain large-scale monitoring or special-category processing. Treat the assessment as a reviewed business record, not an environment variable.

type PrivacyEscalation = { kind: 'rights-request' | 'incident' | 'dpia'; owner: string; openedAt: string };
export function routePrivacyEscalation(kind: PrivacyEscalation['kind']): PrivacyEscalation {
  return { kind, owner: 'dpo@your-company.example', openedAt: new Date().toISOString() };
}

Maintain a designation assessment, a durable contact route, escalation SLAs, and evidence that requests reach an accountable owner. Do not infer that every organisation requires a DPO solely from use of this pattern.

3. Breach notification: preserve decision evidence (gdpr-5)

Build an incident ledger that records facts and decisions without automatically notifying an authority. Notification decisions require human and legal review.

export async function recordPrivacyIncident(incident: Incident) {
  const record = { id: crypto.randomUUID(), observedAt: new Date().toISOString(), systems: incident.systems,
    recordsEstimate: incident.recordsEstimate, containment: incident.containment, decision: 'pending-review' };
  await appendIncidentLedger(record);
  await createEscalation(routePrivacyEscalation('incident'), record.id);
  return record.id;
}

Exercise detection, scope, containment, evidence preservation, decision ownership, and the relevant notification timeline. The Matrix is not a certification of compliance.

Verification checklist

• A subject cannot export another subject’s or tenant’s data.
• Export output excludes credentials, internal flags, and third-party identifiers.
• DPO routing is tested from public contact point to acknowledgement.
• Incident records are access-controlled and retrievable for review.

Continue in the Compliance Matrix to record local implementation evidence.