GDPR for Rails

GDPR governs personal data of EU residents. The technical asks: let users see, export, correct, and delete their data; record the lawful basis; minimize data collection; notify breaches in 72 hours. This skill is the engineering side — get a privacy lawyer for the legal program.

The opinion

Build a Data Subject portal (export + delete) from day one — bolted on later is painful. Record lawful basis on every personal-data field (consent / contract / legitimate interest). Use pseudonymisation (replace identifiers with reference IDs) for analytics. Audit logs of personal-data access survive erasure. Sign Data Processing Agreements with every vendor handling EU data. Skip the cookie banner if you only use strictly-necessary cookies; otherwise use a consent-management platform (CMP).

What's personal data

Anything that identifies a person OR can be combined with other data to do so:

• Name, email, phone, address, DOB
• IP address, device ID, advertising ID, cookies
• Photos, voice recordings
• Account IDs, order history
• Location data
• Behaviour data when linked to a user

If you can answer "is X about a specific person?" with yes (or "with effort"), GDPR applies.