Privacy by Architecture: Operationalizing GDPR Records of Processing Activities and Right-to-Erasure in Enterprise Analytics Platforms
Main Article Content
Abstract
The General Data Protection Regulation (GDPR) obliges controllers to keep a record of processing
activities (ROPA) under Article 30 and to honour the right to erasure under Article 17. In many enterprises both duties
are served by spreadsheets and ticket queues that have no executable link to the warehouses, data lakes and businessintelligence
models in which personal data actually resides. This paper presents a privacy-by-architecture framework in
which the ROPA becomes a machine-readable control plane. Processing activities are linked through a metadata graph
to physical assets, columns, retention rules and subject-identity keys, and a deletion orchestrator derives, executes and
evidences per-asset erasure plans across storage tiers. We describe the metadata model, the identity-resolution and keymanagement
design, the operator self-check cycle, a hash-chained audit evidence trail and the penetration and erasureverification
testing approach, drawing on an implementation at a multinational manufacturing group operating on
Azure and Snowflake. Particular attention is given to storage that resists deletion: append-only lake tables, time-travel
and fail-safe retention, backups, derived aggregates and BI extracts, for which we combine crypto-shredding,
tombstoning with deferred compaction and explicitly bounded residual-exposure windows. On representative data from
the deployment, ROPA-to-asset coverage reached 87% of 1,840 in-scope assets within twelve months, median erasure
turnaround fell from roughly three weeks to four days, and analyst effort per request fell by about 78%. We close by
showing how the same metadata supports CCPA/CPRA, LGPD and PIPL obligations
Article Details
Section
How to Cite
References
[1] European Parliament and Council of the European Union, "Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)," Official Journal of the European Union, L 119, pp. 1–88, May 2016.
[2] European Data Protection Board, "Guidelines 4/2019 on Article 25: Data protection by design and by default," Version 2.0, adopted Oct. 2020.
[3] S. Shastri, M. Wasserman, and V. Chidambaram, "The seven sins of personal-data processing systems under GDPR," in Proc. 11th USENIX Workshop on Hot Topics in Cloud Computing (HotCloud), 2019.
[4] S. Shastri, V. Banakar, M. Wasserman, A. Kumar, and V. Chidambaram, "Understanding and benchmarking the impact of GDPR on database systems," Proc. VLDB Endowment, vol. 13, no. 7, pp. 1064–1077, 2020.
[5] Article 29 Data Protection Working Party, "Guidelines on data protection impact assessment (DPIA) and determining whether processing is 'likely to result in a high risk' for the purposes of Regulation 2016/679," WP 248 rev.01, Oct. 2017.
[6] Article 29 Data Protection Working Party, "Opinion 05/2014 on anonymisation techniques," WP 216, Apr. 2014.
[7] ISO/IEC 27701:2019, "Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidelines," International Organization for Standardization, Geneva, 2019.
[8] M. Schwarzkopf, E. Kohler, M. F. Kaashoek, and R. Morris, "Position: GDPR compliance by construction," in Heterogeneous Data Management, Polystores, and Analytics for Healthcare (Poly/DMAH 2019), LNCS vol. 11721, Springer, 2019, pp. 39–53.
[9] T. Kraska, M. Stonebraker, M. Brodie, S. Servan-Schreiber, and D. Weitzner, "SchengenDB: A data protection database proposal," in Heterogeneous Data Management, Polystores, and Analytics for Healthcare (Poly/DMAH 2019), LNCS vol. 11721, Springer, 2019, pp. 24–38.
[10] J. Reardon, D. Basin, and S. Capkun, "SoK: Secure data deletion," in Proc. IEEE Symposium on Security and Privacy, 2013, pp. 301–315.
[11] D. Boneh and R. J. Lipton, "A revocable backup system," in Proc. 6th USENIX Security Symposium, San Jose, CA, USA, 1996.
[12] R. Kissel, A. Regenscheid, M. Scholl, and K. Stine, "Guidelines for media sanitization," NIST Special Publication 800-88, Rev. 1, Dec. 2014.
[13] P. O'Neil, E. Cheng, D. Gawlick, and E. O'Neil, "The log-structured merge-tree (LSM-tree)," Acta Informatica, vol. 33, no. 4, pp. 351–385, 1996.
[14] M. Armbrust et al., "Delta Lake: High-performance ACID table storage over cloud object stores," Proc. VLDB Endowment, vol. 13, no. 12, pp. 3411–3424, 2020.
[15] Snowflake Inc., "Understanding & using Time Travel" and "Understanding & viewing Fail-safe," Snowflake Documentation, 2021.
[16] R. Kimball and M. Ross, The Data Warehouse Toolkit: The Definitive Guide to Dimensional Modeling, 3rd ed. Indianapolis, IN, USA: Wiley, 2013.
[17] DAMA International, DAMA-DMBOK: Data Management Body of Knowledge, 2nd ed. Basking Ridge, NJ, USA: Technics Publications, 2017.
[18] Microsoft, "Azure Purview documentation: Introduction to Azure Purview," Microsoft Docs, 2021.
[19] L. Sweeney, "k-anonymity: A model for protecting privacy," International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, vol. 10, no. 5, pp. 557–570, 2002.
[20] C. Dwork and A. Roth, "The algorithmic foundations of differential privacy," Foundations and Trends in Theoretical Computer Science, vol. 9, no. 3–4, pp. 211–407, 2014.
[21] OWASP Foundation, "Web Security Testing Guide," Version 4.2, Dec. 2020.
[22] California Consumer Privacy Act of 2018, Cal. Civ. Code §§ 1798.100–1798.199, 2018.
[23] California Privacy Rights Act of 2020 (Proposition 24), approved by California voters, Nov. 2020.
[24] Brazil, "Lei Geral de Proteção de Dados Pessoais (LGPD)," Law No. 13.709, Aug. 2018.
[25] Standing Committee of the National People's Congress, "Personal Information Protection Law of the People's Republic of China," adopted Aug. 20, 2021, effective Nov. 1, 2021.
[26] L. Bourtoule et al., "Machine unlearning," in Proc. IEEE Symposium on Security and Privacy, 2021, pp. 141–159.