# GDPR Compliance — Data Protection & Privacy Management

Ensure lead pipeline operations comply with GDPR, CCPA, and GCC data protection regulations. Reviews data processing, manages consent, and maintains audit trails.

## When This Skill Activates

Trigger phrases: "GDPR check", "compliance review", "data protection", "privacy audit", "legal basis", "data subject request", "right to be forgotten", "is this GDPR compliant"

## Regulatory Framework

### GDPR (EU/UK) — Primary
- **Legal basis**: Legitimate interest for B2B prospecting using publicly available data
- **Data minimization**: Only collect what's needed for outreach
- **Purpose limitation**: Data used solely for business communication
- **Storage limitation**: Define retention periods
- **Data subject rights**: Right to access, rectify, erase, restrict, port

### Qatar Data Protection (PDPL)
- Qatar Financial Centre data protection regulations
- QFC-specific requirements for financial services data
- Cross-border transfer restrictions

### CCPA (California, if applicable)
- Right to know, delete, opt-out
- No sale of personal information

## Compliance Checklist for Lead Pipeline

### Data Collection (Scraping Phase)
- [x] Only public registry data (Companies House, Qatar registries)
- [x] Legal basis: legitimate interest (public business data)
- [x] Data source tracked in `GDPRAuditEntry`
- [ ] Privacy policy published and accessible
- [ ] Retention period defined (recommend: 12 months max)

### Data Processing (Enrichment Phase)
- [x] Web search uses publicly available information only
- [x] Contact info extracted from public sources
- [x] Data source recorded as "web_search_public_data"
- [ ] No scraping of social media profiles without consent
- [ ] Employee personal emails excluded (use business emails only)

### Communication (Send Phase)
- [x] Unsubscribe headers included (List-Unsubscribe, List-Unsubscribe-Post)
- [x] Sender identity clearly identified
- [ ] Unsubscribe mechanism functional and monitored
- [ ] Opt-out honored within 10 business days
- [ ] Suppression list maintained

### Audit Trail
- [x] `GDPRAuditEntry` created for every action
- [x] Timestamp, action, lead, source, legal basis recorded
- [ ] Audit log retention: minimum 3 years
- [ ] Regular audit log review (quarterly recommended)

## Data Subject Request Handling

### Right of Access (Article 15)
```markdown
## Data Subject Access Request Response

**Requestor**: [Name]
**Date**: [Date]
**Response deadline**: [Date + 30 days]

### Data We Hold
| Category | Data | Source | Collected |
|----------|------|--------|-----------|
| Business identity | Company name, number | [Registry] | [Date] |
| Contact info | Email, phone | [Web search] | [Date] |
| Communications | Email content, dates | [Internal] | [Date] |

### Processing Activities
| Activity | Legal Basis | Purpose |
|----------|-------------|---------|
| Collection | Legitimate interest | B2B prospecting |
| Enrichment | Legitimate interest | Contact verification |
| Communication | Legitimate interest | Business outreach |

### Data Recipients
[List any third parties: CRM providers, email services]
```

### Right to Erasure (Article 17)
When processing a deletion request:
1. Identify all campaign data containing the individual
2. Remove from `LeadStore` (all campaign files)
3. Remove from dedup_state.json
4. Add to permanent suppression list
5. Log the deletion in GDPR audit trail
6. Confirm deletion to the requestor within 30 days

### Suppression List Management
Maintain a file at `~/.lead_pipeline/data/suppression_list.json`:
```json
{
  "suppressed_emails": ["user@example.com"],
  "suppressed_domains": ["example.com"],
  "suppressed_companies": ["Example Ltd"],
  "last_updated": "2026-02-27"
}
```
The pipeline MUST check this list before every enrichment and send operation.

## Risk Assessment Matrix

| Risk | Likelihood | Impact | Mitigation |
|------|-----------|--------|------------|
| Sending to personal emails | Medium | High | Filter non-business domains |
| Data breach | Low | Very High | Encrypt stored data, limit access |
| Non-compliance with DSAR | Medium | High | Automated detection & routing |
| Cross-border transfer | Medium | Medium | Use EU/UK hosting for EU data |
| Over-retention | High | Medium | Implement auto-deletion schedule |

## Integration with Lead Pipeline

- Extends `Pipeline.run()` with pre-send compliance checks
- Adds suppression list checking in `EmailSender.send()`
- Enhances `GDPRAuditEntry` with additional metadata
- Provides DSAR response generation from campaign data
- Supports the `lead_pipeline audit <campaign_id>` CLI command

## Key Rules
- ALWAYS check suppression list before sending
- NEVER store data longer than necessary (12 months recommended)
- NEVER send to personal email addresses for B2B outreach
- ALWAYS include unsubscribe mechanism in every email
- ALWAYS respond to data subject requests within 30 days
- Log EVERYTHING — if it's not logged, it didn't happen (for compliance purposes)
- When in doubt, DON'T send — err on the side of caution
