Implementing Compliance and Auditing
1. Configuring GDPR Compliance
| Requirement | Implementation |
|---|
| Lawful basis | Consent, contract, legit interest |
| Right of access | Data export API |
| Right to erasure | Hard delete on request |
| Data portability | JSON/CSV export |
| DPO contact | Public, easily reachable |
| Breach notification | 72h to authority |
| SCCs / IDTA | For non-EEA transfers |
2. Implementing PCI DSS Requirements
| Requirement (v4.0) | Action |
|---|
| Req 3 - Protect stored data | Tokenize PAN, no CVV storage |
| Req 4 - Encrypt transit | TLS 1.2+ everywhere |
| Req 6 - Secure code | SAST, code review |
| Req 8 - Auth | MFA for admin |
| Req 10 - Logging | Daily review, 1yr retention |
| Req 11 - Testing | Quarterly ASV scans, annual pentest |
3. Setting Up SOC 2 Controls
| Trust Principle | Example Control |
|---|
| Security | MFA, encryption, access reviews |
| Availability | SLA monitoring, incident process |
| Processing integrity | Input validation, data checks |
| Confidentiality | NDAs, data classification |
| Privacy | Consent, retention, deletion |
4. Using HIPAA Compliance Features
| Safeguard | Detail |
|---|
| Administrative | BAA with all sub-processors |
| Physical | Data center access controls |
| Technical | Audit logs, encryption at rest/transit |
| Access control | Unique IDs, automatic logoff |
| Integrity | Detect unauthorized modification |
| Transmission security | TLS 1.2+ for ePHI |
5. Configuring Audit Trail Logging
| Field | Detail |
|---|
| who | User ID, service principal |
| what | Action (CREATE, UPDATE, DELETE, READ) |
| when | UTC timestamp w/ ms |
| where | Source IP, region |
| target | Resource ID, type |
| result | success/failure/error code |
| tamper protection | Append-only, hash chain, WORM |
6. Implementing Data Retention Policies
| Data Type | Retention |
|---|
| Audit logs | 7 years (SOX, HIPAA) |
| Access logs | 1 year (PCI) |
| User data | Until deletion request |
| Backups | 30-90 days rolling |
| Marketing data | Per consent (2-3 years typical) |
7. Setting Up Access Logs
Example: Structured access log
{
"ts": "2025-05-20T12:34:56.789Z",
"trace_id": "abc123...",
"actor": { "id": "user_42", "type": "user", "ip": "203.0.113.5" },
"action": "GET",
"resource": "/v1/patients/789/records",
"result": "success",
"status": 200,
"bytes_out": 4096,
"latency_ms": 87,
"user_agent": "Mozilla/5.0..."
}
8. Configuring Sensitive Data Masking
| Field | Mask |
|---|
| Credit card | 411111******1111 |
| Email | j***@example.com |
| SSN | ***-**-1234 |
| Auth tokens | Full redaction in logs |
| Health data | Hash + lookup table |
Warning: Apply masking at log ingestion (not display). Once unmasked data is written to disk, leak risk is permanent.
9. Implementing Right to Deletion
Deletion Workflow
- Verify identity (re-auth, ownership proof)
- Confirm scope (full account vs specific data)
- Soft delete + 30-day grace period
- Cascade to primary DB, search index, cache
- Purge from backups on next rotation
- Notify sub-processors (CRM, analytics)
- Issue deletion confirmation certificate
- Retain proof-of-deletion record (no PII)
10. Using Compliance Reporting
| Report | Audience |
|---|
| SOC 2 Type II | Customers, auditors (annual) |
| PCI AOC | Acquirers (annual) |
| DPIA | Internal DPO, regulator on request |
| Penetration test | Customers under NDA |
| Records of processing (Art. 30) | DPO, regulator |