GDPR Dev

A reference for developers building GDPR-compliant web applications in Europe. These principles apply proactively — if personal data is involved, GDPR applies.

For the full list of anti-patterns, see references/gotchas.md. For schema design, see references/schema-patterns.md.

Top 6 Gotchas

1. PII in logs

console.log(user) or logging request bodies sends personal data to error trackers and log aggregators. Sentry captures console.log calls as breadcrumbs — treat it as a PII risk. Log IDs, not objects.

// Bad
console.log("Processing user:", user);
logger.info({ user });