Data Privacy and GDPR Compliance in 2026: Developer Guide

In This Guide

• 1. The Global Privacy Landscape in 2026
• 2. GDPR Core Principles — What Developers Must Know
• 3. Consent Management — Implementation Patterns
• 4. User Data Rights — Building the Technical Infrastructure
• 5. Privacy by Design — Architecture Decisions
• 6. Data Protection Impact Assessments (DPIA)
• 7. Cross-Border Data Transfers
• 8. Frequently Asked Questions

CREATE TABLE user_consents (
    id          BIGINT PRIMARY KEY AUTO_INCREMENT,
    user_id     BIGINT NOT NULL,
    purpose     VARCHAR(100) NOT NULL,  -- 'marketing_email', 'analytics', 'profiling'
    granted     BOOLEAN NOT NULL,
    granted_at  TIMESTAMP NULL,
    revoked_at  TIMESTAMP NULL,
    ip_address  VARCHAR(45),            -- Record where consent was given
    user_agent  TEXT,                    -- Record how consent was given
    consent_text TEXT NOT NULL,          -- Exact text the user agreed to
    version     VARCHAR(20) NOT NULL,    -- Policy version at time of consent

    INDEX idx_user_purpose (user_id, purpose),
    INDEX idx_purpose_granted (purpose, granted)
);

-- Check consent before processing
-- ✅ Always check at the point of use, not just at collection
SELECT granted FROM user_consents
WHERE user_id = ? AND purpose = ? AND granted = TRUE
AND revoked_at IS NULL
ORDER BY granted_at DESC LIMIT 1;

// ❌ BAD — loads analytics before consent
<script src="https://www.googletagmanager.com/gtag/js"></script>

// ✅ GOOD — only loads after explicit consent
function initAnalytics() {
  if (getConsent('analytics')) {
    const script = document.createElement('script');
    script.src = 'https://www.googletagmanager.com/gtag/js?id=G-XXXXX';
    document.head.appendChild(script);
  }
}

// Consent categories — let users choose
const CONSENT_CATEGORIES = {
  necessary: { required: true, description: 'Session, security, preferences' },
  analytics: { required: false, description: 'Page views, usage patterns' },
  marketing: { required: false, description: 'Ad targeting, retargeting' },
  functional: { required: false, description: 'Chat widget, video embeds' },
};

async function handleDeletionRequest(userId) {
  // 1. Verify identity (prevent unauthorized deletion)
  await verifyIdentity(userId);

  // 2. Check for legal holds (tax records, active disputes)
  const holds = await checkLegalHolds(userId);
  if (holds.length > 0) {
    return { partial: true, retained: holds.map(h => h.reason) };
  }

  // 3. Delete from primary database
  await db.execute('DELETE FROM user_profiles WHERE user_id = ?', [userId]);
  await db.execute('DELETE FROM user_consents WHERE user_id = ?', [userId]);
  await db.execute('DELETE FROM user_activity WHERE user_id = ?', [userId]);

  // 4. Anonymize records we must keep (financial transactions)
  await db.execute(`
    UPDATE orders SET
      customer_name = 'DELETED',
      customer_email = 'deleted@deleted.com',
      shipping_address = 'DELETED'
    WHERE user_id = ?
  `, [userId]);

  // 5. Queue deletion from third-party services
  await queue.publish('user.deletion', {
    userId,
    services: ['analytics', 'email_provider', 'payment_processor'],
  });

  // 6. Log the deletion for audit trail
  await auditLog.record('data_deletion', {
    userId, requestedAt: new Date(), completedAt: new Date(),
  });

  // 7. Note: Backups — apply deletion at next backup rotation
  // Don't restore deleted user data from backups
}

The most common GDPR violation we help clients fix isn't a missing cookie banner — it's log files. Application logs routinely contain email addresses, IP addresses, phone numbers, and even passwords in error messages. That's personal data, subject to GDPR. Our approach: log user IDs (not emails), mask PII in log output, and set aggressive retention on log storage. A 90-day log retention policy is usually sufficient for debugging and dramatically reduces your data footprint.

Related Articles