🛡️ GDPR Compliance on AlmaLinux Systems: Complete Privacy Protection Guide

Welcome to the essential world of data protection and privacy compliance! 🔐 Today we’ll master implementing GDPR (General Data Protection Regulation) compliance on AlmaLinux systems, ensuring your organization meets Europe’s gold standard for data protection. Think of GDPR as building an impenetrable fortress around personal data! 🏰

With GDPR fines reaching up to €20 million or 4% of global turnover (whichever is higher), compliance isn’t optional - it’s business-critical. Whether you’re a startup handling user data or an enterprise managing millions of records, this guide will make your AlmaLinux systems GDPR-ready! 💪

🤔 Why is GDPR Compliance Critical?

GDPR compliance on Linux systems is mandatory for modern business! ⚡ Here’s why it’s absolutely essential:

• 💰 Avoid Massive Fines - Penalties up to €20M or 4% of global revenue
• 🌍 Global Requirement - Applies to ANY organization handling EU data
• 🏢 Business Continuity - Non-compliance can shut down operations
• 🤝 Customer Trust - Users demand privacy protection
• 📈 Competitive Advantage - Privacy-first approach attracts customers
• ⚖️ Legal Protection - Demonstrates due diligence in court
• 🔒 Data Security - Protects against breaches and data loss
• 🎯 Industry Standard - Privacy by design is becoming the norm

🎯 What You Need

Before implementing GDPR compliance on your systems, ensure you have:

✅ AlmaLinux system with administrative access
✅ Understanding of data flows in your organization
✅ Legal guidance (this guide covers technical implementation)
✅ Inventory of personal data your systems process
✅ Security tools (encryption, logging, monitoring)
✅ Documentation systems for compliance records
✅ Staff training materials for privacy awareness
✅ Incident response procedures for data breaches

📝 Understanding GDPR Requirements

Let’s break down the key GDPR principles and their technical implications! 🛠️

The Seven GDPR Principles

# Create GDPR compliance documentation structure
sudo mkdir -p /etc/gdpr-compliance/{policies,procedures,logs,documentation}
sudo mkdir -p /var/log/gdpr-compliance
sudo chmod 750 /etc/gdpr-compliance /var/log/gdpr-compliance
# Creates secure directories for compliance documentation

# Document the seven GDPR principles
cat > /etc/gdpr-compliance/documentation/gdpr-principles.md << 'EOF'
# GDPR Seven Principles for Technical Implementation

## 1. Lawfulness, Fairness, and Transparency
- Technical: Clear data collection notices, transparent processing
- Implementation: User consent mechanisms, privacy notices

## 2. Purpose Limitation
- Technical: Data used only for stated purposes
- Implementation: Access controls, data usage monitoring

## 3. Data Minimization
- Technical: Collect only necessary data
- Implementation: Field validation, data collection limits

## 4. Accuracy
- Technical: Keep data accurate and up-to-date
- Implementation: Data validation, update mechanisms

## 5. Storage Limitation
- Technical: Retain data only as long as necessary
- Implementation: Automated data deletion, retention policies

## 6. Integrity and Confidentiality (Security)
- Technical: Protect data against unauthorized access
- Implementation: Encryption, access controls, monitoring

## 7. Accountability
- Technical: Demonstrate compliance with all principles
- Implementation: Audit logs, documentation, evidence
EOF
# Documents GDPR principles for technical teams

Data Subject Rights Implementation

# Create data subject rights implementation guide
cat > /etc/gdpr-compliance/documentation/data-subject-rights.md << 'EOF'
# GDPR Data Subject Rights - Technical Implementation

## Right to Information (Articles 13-14)
- Privacy notices at data collection
- Clear explanation of processing purposes
- Contact details for data controller

## Right of Access (Article 15)
- Provide copy of personal data
- Information about processing purposes
- Data retention periods

## Right to Rectification (Article 16)
- Correct inaccurate personal data
- Complete incomplete data
- Notify third parties of corrections

## Right to Erasure/"Right to be Forgotten" (Article 17)
- Delete data when no longer necessary
- Delete when consent is withdrawn
- Technical implementation of data deletion

## Right to Restrict Processing (Article 18)
- Temporarily halt processing
- Mark data as restricted
- Maintain restricted data separately

## Right to Data Portability (Article 20)
- Export data in machine-readable format
- Transfer data to another controller
- Provide structured, commonly used formats

## Right to Object (Article 21)
- Stop processing for direct marketing
- Object to profiling
- Implement opt-out mechanisms

## Rights Related to Automated Decision Making (Article 22)
- Avoid solely automated decision-making
- Provide human intervention option
- Explain logic of automated processing
EOF

🔧 Data Encryption Implementation

Let’s implement comprehensive data encryption for GDPR compliance! 🔐

Database Encryption

# Install and configure database encryption
sudo dnf install -y mariadb-server mariadb

# Configure MariaDB with encryption at rest
sudo cat >> /etc/my.cnf.d/mariadb-server.cnf << 'EOF'
[mysqld]
# GDPR Compliance - Encryption at Rest
plugin_load_add = file_key_management

# Enable encryption
encrypt_binlog = ON
encrypt_tmp_disk_tables = ON
encrypt_tmp_files = ON

# Key management
file_key_management_filename = /etc/mysql/keys/encryption.key
file_key_management_filekey = FILE:/etc/mysql/keys/master.key

# SSL/TLS for connections
ssl_cert = /etc/ssl/certs/mysql-cert.pem
ssl_key = /etc/ssl/private/mysql-key.pem
require_secure_transport = ON

# Audit logging for GDPR
plugin_load_add = server_audit
server_audit = FORCE_PLUS_PERMANENT
server_audit_events = CONNECT,QUERY,TABLE
server_audit_logging = ON
server_audit_file_path = /var/log/mysql/audit.log
server_audit_file_rotate_size = 100000000
server_audit_file_rotations = 5
EOF

# Create encryption keys directory
sudo mkdir -p /etc/mysql/keys
sudo chmod 750 /etc/mysql/keys
sudo chown mysql:mysql /etc/mysql/keys

# Generate encryption keys
sudo openssl rand -hex 32 | sudo tee /etc/mysql/keys/encryption.key
sudo openssl rand -hex 32 | sudo tee /etc/mysql/keys/master.key
sudo chmod 600 /etc/mysql/keys/*
sudo chown mysql:mysql /etc/mysql/keys/*

# Start and enable MariaDB
sudo systemctl enable --now mariadb

File System Encryption

# Set up encrypted storage for personal data
sudo fallocate -l 1G /var/encrypted-data.img
sudo cryptsetup luksFormat /var/encrypted-data.img
# You'll be prompted to set a passphrase

# Open and mount encrypted storage
sudo cryptsetup open /var/encrypted-data.img gdpr-data
sudo mkfs.ext4 /dev/mapper/gdpr-data
sudo mkdir -p /mnt/gdpr-secure-data
sudo mount /dev/mapper/gdpr-data /mnt/gdpr-secure-data

# Set up automatic mounting with key file
sudo dd if=/dev/urandom of=/etc/gdpr-key bs=512 count=8
sudo chmod 600 /etc/gdpr-key
sudo cryptsetup luksAddKey /var/encrypted-data.img /etc/gdpr-key

# Add to fstab for automatic mounting
echo '/var/encrypted-data.img /mnt/gdpr-secure-data ext4 loop,_netdev 0 0' | sudo tee -a /etc/fstab

Application-Level Encryption

# Create encryption utilities for applications
cat > /etc/gdpr-compliance/procedures/encryption-utils.py << 'EOF'
#!/usr/bin/env python3
"""
GDPR Compliance Encryption Utilities
Provides field-level encryption for personal data
"""

import os
import base64
import hashlib
from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
import json
from datetime import datetime, timedelta

class GDPREncryption:
    def __init__(self, master_key=None):
        if master_key is None:
            master_key = os.environ.get('GDPR_MASTER_KEY', 'default-key-change-in-production')
        
        # Derive encryption key from master key
        salt = b'gdpr-compliance-salt'  # Use unique salt per installation
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=salt,
            iterations=100000,
        )
        key = base64.urlsafe_b64encode(kdf.derive(master_key.encode()))
        self.cipher_suite = Fernet(key)
    
    def encrypt_field(self, data, purpose="general"):
        """Encrypt a field with metadata for GDPR compliance"""
        if data is None:
            return None
        
        # Create encryption metadata
        metadata = {
            'encrypted_at': datetime.utcnow().isoformat(),
            'purpose': purpose,
            'version': '1.0'
        }
        
        # Combine data and metadata
        payload = {
            'data': data,
            'metadata': metadata
        }
        
        json_payload = json.dumps(payload)
        encrypted_data = self.cipher_suite.encrypt(json_payload.encode())
        return base64.urlsafe_b64encode(encrypted_data).decode()
    
    def decrypt_field(self, encrypted_data):
        """Decrypt a field and return data with metadata"""
        if encrypted_data is None:
            return None, None
        
        try:
            decoded_data = base64.urlsafe_b64decode(encrypted_data.encode())
            decrypted_json = self.cipher_suite.decrypt(decoded_data)
            payload = json.loads(decrypted_json.decode())
            
            return payload['data'], payload['metadata']
        except Exception as e:
            raise ValueError(f"Failed to decrypt data: {e}")
    
    def hash_for_indexing(self, data):
        """Create searchable hash of data (one-way)"""
        if data is None:
            return None
        return hashlib.sha256(data.encode()).hexdigest()

class GDPRDataRetention:
    def __init__(self):
        self.retention_policies = {
            'user_profiles': timedelta(days=2*365),  # 2 years
            'transaction_logs': timedelta(days=7*365),  # 7 years
            'marketing_data': timedelta(days=365),  # 1 year
            'support_tickets': timedelta(days=3*365),  # 3 years
        }
    
    def should_delete(self, data_type, created_date):
        """Check if data should be deleted based on retention policy"""
        if data_type not in self.retention_policies:
            return False
        
        retention_period = self.retention_policies[data_type]
        expiry_date = created_date + retention_period
        
        return datetime.utcnow() > expiry_date
    
    def get_deletion_candidates(self, data_type):
        """Get list of records that should be deleted"""
        # This would connect to your database and return candidates
        # Implementation depends on your specific database schema
        pass

# Example usage
if __name__ == "__main__":
    encryption = GDPREncryption()
    
    # Encrypt personal data
    email = "[email protected]"
    encrypted_email = encryption.encrypt_field(email, purpose="user_authentication")
    print(f"Encrypted email: {encrypted_email}")
    
    # Decrypt personal data
    decrypted_email, metadata = encryption.decrypt_field(encrypted_email)
    print(f"Decrypted email: {decrypted_email}")
    print(f"Metadata: {metadata}")
    
    # Create searchable hash
    email_hash = encryption.hash_for_indexing(email)
    print(f"Email hash for indexing: {email_hash}")
EOF

# Make script executable
sudo chmod +x /etc/gdpr-compliance/procedures/encryption-utils.py

# Install required Python packages
sudo dnf install -y python3-pip
pip3 install cryptography

🌟 Access Controls and User Management

Implement proper access controls for GDPR compliance! 👥

Role-Based Access Control

# Create GDPR-compliant user groups
sudo groupadd gdpr-admins
sudo groupadd gdpr-processors
sudo groupadd gdpr-viewers
sudo groupadd gdpr-auditors

# Create specialized users for data processing
sudo useradd -g gdpr-processors -s /bin/bash data-processor
sudo useradd -g gdpr-viewers -s /bin/bash data-viewer
sudo useradd -g gdpr-auditors -s /bin/bash audit-user

# Set up directory permissions for different access levels
sudo mkdir -p /var/gdpr-data/{personal,sensitive,public}
sudo chown root:gdpr-processors /var/gdpr-data/personal
sudo chown root:gdpr-processors /var/gdpr-data/sensitive
sudo chown root:gdpr-viewers /var/gdpr-data/public

# Set strict permissions
sudo chmod 750 /var/gdpr-data/personal    # rwxr-x--- (processors only)
sudo chmod 700 /var/gdpr-data/sensitive   # rwx------ (admins only)
sudo chmod 755 /var/gdpr-data/public      # rwxr-xr-x (all can read)

# Configure sudo rules for GDPR operations
cat > /etc/sudoers.d/gdpr-compliance << 'EOF'
# GDPR Compliance - Restricted Access Rules

# GDPR Administrators - Full access to compliance tools
%gdpr-admins ALL=(ALL) NOPASSWD: /usr/local/bin/gdpr-*, /bin/systemctl * gdpr-*

# Data Processors - Limited access to processing tools
%gdpr-processors ALL=(data-processor) NOPASSWD: /usr/local/bin/process-personal-data
%gdpr-processors ALL=(ALL) NOPASSWD: /usr/local/bin/gdpr-export-data, /usr/local/bin/gdpr-delete-data

# Auditors - Read-only access to logs and reports
%gdpr-auditors ALL=(ALL) NOPASSWD: /usr/local/bin/gdpr-audit-report, /usr/bin/tail /var/log/gdpr-*

# Prevent access to encryption keys
%gdpr-processors ALL=(ALL) !/usr/bin/cat /etc/mysql/keys/*, !/usr/bin/vim /etc/mysql/keys/*
EOF

Database Access Controls

# Create GDPR-compliant database users and permissions
sudo mysql << 'EOF'
-- Create GDPR compliance database
CREATE DATABASE IF NOT EXISTS gdpr_compliance;

-- Create specialized database users
CREATE USER 'gdpr_admin'@'localhost' IDENTIFIED BY 'SecurePassword123!';
CREATE USER 'gdpr_processor'@'localhost' IDENTIFIED BY 'ProcessorPass456!';
CREATE USER 'gdpr_auditor'@'localhost' IDENTIFIED BY 'AuditorPass789!';

-- Admin permissions (full access)
GRANT ALL PRIVILEGES ON gdpr_compliance.* TO 'gdpr_admin'@'localhost';

-- Processor permissions (read/write personal data tables)
GRANT SELECT, INSERT, UPDATE ON gdpr_compliance.personal_data TO 'gdpr_processor'@'localhost';
GRANT SELECT, INSERT, UPDATE ON gdpr_compliance.consent_records TO 'gdpr_processor'@'localhost';
GRANT SELECT ON gdpr_compliance.retention_policies TO 'gdpr_processor'@'localhost';

-- Auditor permissions (read-only access to audit tables)
GRANT SELECT ON gdpr_compliance.audit_log TO 'gdpr_auditor'@'localhost';
GRANT SELECT ON gdpr_compliance.data_access_log TO 'gdpr_auditor'@'localhost';
GRANT SELECT ON gdpr_compliance.deletion_log TO 'gdpr_auditor'@'localhost';

FLUSH PRIVILEGES;

-- Create GDPR compliance tables
USE gdpr_compliance;

-- Personal data inventory
CREATE TABLE personal_data (
    id INT AUTO_INCREMENT PRIMARY KEY,
    data_subject_id VARCHAR(255) NOT NULL,
    data_type VARCHAR(100) NOT NULL,
    encrypted_value TEXT,
    purpose VARCHAR(255) NOT NULL,
    legal_basis VARCHAR(100) NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    retention_until DATE,
    INDEX idx_data_subject (data_subject_id),
    INDEX idx_retention (retention_until)
) ENGINE=InnoDB;

-- Consent management
CREATE TABLE consent_records (
    id INT AUTO_INCREMENT PRIMARY KEY,
    data_subject_id VARCHAR(255) NOT NULL,
    purpose VARCHAR(255) NOT NULL,
    consent_given BOOLEAN NOT NULL,
    consent_date TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    consent_method VARCHAR(100),
    withdrawn_date TIMESTAMP NULL,
    INDEX idx_subject_purpose (data_subject_id, purpose)
) ENGINE=InnoDB;

-- Audit logging
CREATE TABLE audit_log (
    id INT AUTO_INCREMENT PRIMARY KEY,
    action VARCHAR(100) NOT NULL,
    data_subject_id VARCHAR(255),
    user_id VARCHAR(100) NOT NULL,
    ip_address VARCHAR(45),
    timestamp TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    details JSON,
    INDEX idx_timestamp (timestamp),
    INDEX idx_subject (data_subject_id),
    INDEX idx_action (action)
) ENGINE=InnoDB;

-- Data access logging
CREATE TABLE data_access_log (
    id INT AUTO_INCREMENT PRIMARY KEY,
    data_subject_id VARCHAR(255) NOT NULL,
    accessed_by VARCHAR(100) NOT NULL,
    access_type VARCHAR(50) NOT NULL,
    purpose VARCHAR(255),
    timestamp TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    ip_address VARCHAR(45),
    INDEX idx_subject_time (data_subject_id, timestamp)
) ENGINE=InnoDB;

-- Deletion logging
CREATE TABLE deletion_log (
    id INT AUTO_INCREMENT PRIMARY KEY,
    data_subject_id VARCHAR(255) NOT NULL,
    deleted_by VARCHAR(100) NOT NULL,
    deletion_reason VARCHAR(255) NOT NULL,
    deletion_date TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    data_types JSON,
    INDEX idx_deletion_date (deletion_date)
) ENGINE=InnoDB;

EOF

✅ Data Subject Rights Implementation

Let’s implement the technical systems for handling data subject requests! 🎯

Right to Access Implementation

# Create data export utility
cat > /usr/local/bin/gdpr-export-data << 'EOF'
#!/bin/bash
# GDPR Data Export Utility - Article 15 (Right of Access)

set -euo pipefail

SUBJECT_ID="$1"
OUTPUT_DIR="/tmp/gdpr-exports"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
EXPORT_FILE="${OUTPUT_DIR}/data_export_${SUBJECT_ID}_${TIMESTAMP}.json"

# Validate input
if [[ -z "$SUBJECT_ID" ]]; then
    echo "Usage: $0 <data_subject_id>"
    exit 1
fi

# Create output directory
mkdir -p "$OUTPUT_DIR"

# Log the export request
logger -t gdpr-export "Data export requested for subject: $SUBJECT_ID"

# Export personal data from database
mysql -u gdpr_processor -p'ProcessorPass456!' gdpr_compliance << SQL | jq . > "$EXPORT_FILE"
SELECT JSON_OBJECT(
    'export_info', JSON_OBJECT(
        'subject_id', '${SUBJECT_ID}',
        'export_date', NOW(),
        'format', 'JSON',
        'requested_by', USER()
    ),
    'personal_data', (
        SELECT JSON_ARRAYAGG(
            JSON_OBJECT(
                'data_type', data_type,
                'purpose', purpose,
                'legal_basis', legal_basis,
                'created_at', created_at,
                'retention_until', retention_until
            )
        )
        FROM personal_data 
        WHERE data_subject_id = '${SUBJECT_ID}'
    ),
    'consent_records', (
        SELECT JSON_ARRAYAGG(
            JSON_OBJECT(
                'purpose', purpose,
                'consent_given', consent_given,
                'consent_date', consent_date,
                'consent_method', consent_method,
                'withdrawn_date', withdrawn_date
            )
        )
        FROM consent_records 
        WHERE data_subject_id = '${SUBJECT_ID}'
    ),
    'access_history', (
        SELECT JSON_ARRAYAGG(
            JSON_OBJECT(
                'access_date', timestamp,
                'accessed_by', accessed_by,
                'access_type', access_type,
                'purpose', purpose
            )
        )
        FROM data_access_log 
        WHERE data_subject_id = '${SUBJECT_ID}'
        ORDER BY timestamp DESC 
        LIMIT 50
    )
) AS export_data;
SQL

# Log the successful export
mysql -u gdpr_auditor -p'AuditorPass789!' gdpr_compliance << SQL
INSERT INTO audit_log (action, data_subject_id, user_id, ip_address, details) 
VALUES (
    'DATA_EXPORT', 
    '${SUBJECT_ID}', 
    USER(), 
    '$(who am i | awk '{print $5}' | tr -d '()')', 
    JSON_OBJECT('export_file', '${EXPORT_FILE}')
);
SQL

echo "✅ Data export completed: $EXPORT_FILE"
echo "📧 Provide this file to the data subject within 30 days"

# Set secure permissions
chmod 600 "$EXPORT_FILE"
EOF

sudo chmod +x /usr/local/bin/gdpr-export-data

Right to Erasure (Right to be Forgotten)

# Create data deletion utility
cat > /usr/local/bin/gdpr-delete-data << 'EOF'
#!/bin/bash
# GDPR Data Deletion Utility - Article 17 (Right to Erasure)

set -euo pipefail

SUBJECT_ID="$1"
REASON="${2:-user_request}"
DRY_RUN="${3:-false}"

if [[ -z "$SUBJECT_ID" ]]; then
    echo "Usage: $0 <data_subject_id> [reason] [dry_run]"
    echo "Example: $0 user123 'consent_withdrawn' false"
    exit 1
fi

echo "🗑️  GDPR Data Deletion Process Starting..."
echo "Subject ID: $SUBJECT_ID"
echo "Reason: $REASON"
echo "Dry Run: $DRY_RUN"

# Log deletion request
logger -t gdpr-deletion "Data deletion requested for subject: $SUBJECT_ID (reason: $REASON)"

# Check what data exists
echo "📊 Analyzing existing data..."
DATA_COUNT=$(mysql -u gdpr_processor -p'ProcessorPass456!' gdpr_compliance -N << SQL
SELECT COUNT(*) FROM personal_data WHERE data_subject_id = '${SUBJECT_ID}';
SQL
)

if [[ "$DATA_COUNT" -eq 0 ]]; then
    echo "ℹ️  No personal data found for subject: $SUBJECT_ID"
    exit 0
fi

echo "📋 Found $DATA_COUNT personal data records"

# Collect data types before deletion (for logging)
DATA_TYPES=$(mysql -u gdpr_processor -p'ProcessorPass456!' gdpr_compliance -N << SQL
SELECT JSON_ARRAYAGG(DISTINCT data_type) 
FROM personal_data 
WHERE data_subject_id = '${SUBJECT_ID}';
SQL
)

if [[ "$DRY_RUN" == "true" ]]; then
    echo "🔍 DRY RUN - Would delete the following:"
    mysql -u gdpr_processor -p'ProcessorPass456!' gdpr_compliance << SQL
SELECT 
    data_type,
    purpose,
    created_at,
    retention_until
FROM personal_data 
WHERE data_subject_id = '${SUBJECT_ID}';
SQL
    echo "✅ Dry run completed. Use 'false' as third parameter to actually delete."
    exit 0
fi

# Perform actual deletion
echo "🗑️  Deleting personal data..."

# Delete from personal_data table
mysql -u gdpr_processor -p'ProcessorPass456!' gdpr_compliance << SQL
DELETE FROM personal_data WHERE data_subject_id = '${SUBJECT_ID}';
DELETE FROM consent_records WHERE data_subject_id = '${SUBJECT_ID}';
-- Note: Keep audit logs for legal compliance, but anonymize them
UPDATE audit_log SET data_subject_id = 'DELETED' WHERE data_subject_id = '${SUBJECT_ID}';
UPDATE data_access_log SET data_subject_id = 'DELETED' WHERE data_subject_id = '${SUBJECT_ID}';
SQL

# Log the deletion
mysql -u gdpr_auditor -p'AuditorPass789!' gdpr_compliance << SQL
INSERT INTO deletion_log (data_subject_id, deleted_by, deletion_reason, data_types) 
VALUES (
    '${SUBJECT_ID}', 
    USER(), 
    '${REASON}', 
    '${DATA_TYPES}'
);

INSERT INTO audit_log (action, data_subject_id, user_id, details) 
VALUES (
    'DATA_DELETION', 
    '${SUBJECT_ID}', 
    USER(), 
    JSON_OBJECT(
        'reason', '${REASON}',
        'data_types', CAST('${DATA_TYPES}' AS JSON),
        'records_deleted', ${DATA_COUNT}
    )
);
SQL

# Clean up encrypted files if they exist
if [[ -d "/mnt/gdpr-secure-data/$SUBJECT_ID" ]]; then
    echo "🔒 Removing encrypted data files..."
    rm -rf "/mnt/gdpr-secure-data/$SUBJECT_ID"
fi

echo "✅ Data deletion completed for subject: $SUBJECT_ID"
echo "📝 Deletion logged for compliance audit"

# Send notification (implement according to your notification system)
logger -t gdpr-deletion "COMPLETED: Data deletion for $SUBJECT_ID ($REASON)"
EOF

sudo chmod +x /usr/local/bin/gdpr-delete-data

Data Portability Implementation

# Create data portability utility
cat > /usr/local/bin/gdpr-portability << 'EOF'
#!/bin/bash
# GDPR Data Portability Utility - Article 20

set -euo pipefail

SUBJECT_ID="$1"
FORMAT="${2:-json}"  # json, csv, xml
OUTPUT_DIR="/tmp/gdpr-portability"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)

if [[ -z "$SUBJECT_ID" ]]; then
    echo "Usage: $0 <data_subject_id> [format]"
    echo "Formats: json, csv, xml"
    exit 1
fi

mkdir -p "$OUTPUT_DIR"

echo "📦 Creating portable data package for: $SUBJECT_ID"
echo "🔧 Format: $FORMAT"

case $FORMAT in
    "json")
        OUTPUT_FILE="${OUTPUT_DIR}/portable_data_${SUBJECT_ID}_${TIMESTAMP}.json"
        
        mysql -u gdpr_processor -p'ProcessorPass456!' gdpr_compliance << SQL | jq . > "$OUTPUT_FILE"
        SELECT JSON_OBJECT(
            'data_subject_id', '${SUBJECT_ID}',
            'export_timestamp', NOW(),
            'format', 'json',
            'data_controller', 'Your Organization Name',
            'contact', '[email protected]',
            'portable_data', (
                SELECT JSON_ARRAYAGG(
                    JSON_OBJECT(
                        'type', data_type,
                        'value', encrypted_value,
                        'purpose', purpose,
                        'created', created_at
                    )
                )
                FROM personal_data 
                WHERE data_subject_id = '${SUBJECT_ID}'
                  AND purpose IN ('service_provision', 'contract_performance')
            )
        ) AS portable_export;
SQL
        ;;
        
    "csv")
        OUTPUT_FILE="${OUTPUT_DIR}/portable_data_${SUBJECT_ID}_${TIMESTAMP}.csv"
        
        mysql -u gdpr_processor -p'ProcessorPass456!' gdpr_compliance << SQL > "$OUTPUT_FILE"
        SELECT 
            'data_type',
            'encrypted_value',
            'purpose',
            'created_at'
        UNION ALL
        SELECT 
            data_type,
            encrypted_value,
            purpose,
            created_at
        FROM personal_data 
        WHERE data_subject_id = '${SUBJECT_ID}'
          AND purpose IN ('service_provision', 'contract_performance')
        INTO OUTFILE '/tmp/portable_${SUBJECT_ID}.csv'
        FIELDS TERMINATED BY ','
        OPTIONALLY ENCLOSED BY '"'
        LINES TERMINATED BY '\n';
SQL
        mv "/tmp/portable_${SUBJECT_ID}.csv" "$OUTPUT_FILE"
        ;;
        
    *)
        echo "❌ Unsupported format: $FORMAT"
        exit 1
        ;;
esac

# Log the portability request
mysql -u gdpr_auditor -p'AuditorPass789!' gdpr_compliance << SQL
INSERT INTO audit_log (action, data_subject_id, user_id, details) 
VALUES (
    'DATA_PORTABILITY', 
    '${SUBJECT_ID}', 
    USER(), 
    JSON_OBJECT(
        'format', '${FORMAT}',
        'output_file', '${OUTPUT_FILE}'
    )
);
SQL

echo "✅ Portable data package created: $OUTPUT_FILE"
echo "📧 This file can be provided to the data subject or transferred to another controller"

chmod 600 "$OUTPUT_FILE"
EOF

sudo chmod +x /usr/local/bin/gdpr-portability

🎮 Quick Examples

Let’s practice with real GDPR compliance scenarios! 🎯

Example 1: Automated Data Retention

# Create automated data retention script
cat > /usr/local/bin/gdpr-retention-cleanup << 'EOF'
#!/bin/bash
# Automated Data Retention Compliance

set -euo pipefail

LOGFILE="/var/log/gdpr-compliance/retention-cleanup.log"
DRY_RUN="${1:-false}"

log_message() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOGFILE"
}

log_message "🔄 Starting GDPR retention cleanup process"

if [[ "$DRY_RUN" == "true" ]]; then
    log_message "🔍 DRY RUN MODE - No actual deletions will be performed"
fi

# Find records that exceed retention period
EXPIRED_RECORDS=$(mysql -u gdpr_processor -p'ProcessorPass456!' gdpr_compliance -N << 'SQL'
SELECT COUNT(*)
FROM personal_data 
WHERE retention_until < CURDATE() 
  AND retention_until IS NOT NULL;
SQL
)

if [[ "$EXPIRED_RECORDS" -eq 0 ]]; then
    log_message "✅ No records found exceeding retention period"
    exit 0
fi

log_message "📋 Found $EXPIRED_RECORDS records exceeding retention period"

# Get list of subjects with expired data
mysql -u gdpr_processor -p'ProcessorPass456!' gdpr_compliance -N << 'SQL' | while read -r subject_id; do
SELECT DISTINCT data_subject_id
FROM personal_data 
WHERE retention_until < CURDATE() 
  AND retention_until IS NOT NULL;
SQL

    log_message "⏰ Processing expired data for subject: $subject_id"
    
    if [[ "$DRY_RUN" != "true" ]]; then
        # Call deletion utility
        /usr/local/bin/gdpr-delete-data "$subject_id" "retention_period_expired" false
    else
        log_message "🔍 DRY RUN: Would delete data for subject $subject_id"
    fi
done

log_message "✅ Retention cleanup process completed"

# Generate retention report
REPORT_FILE="/var/log/gdpr-compliance/retention-report-$(date +%Y%m%d).json"
mysql -u gdpr_auditor -p'AuditorPass789!' gdpr_compliance << SQL | jq . > "$REPORT_FILE"
SELECT JSON_OBJECT(
    'report_date', NOW(),
    'total_subjects', (SELECT COUNT(DISTINCT data_subject_id) FROM personal_data),
    'subjects_with_retention', (SELECT COUNT(DISTINCT data_subject_id) FROM personal_data WHERE retention_until IS NOT NULL),
    'expired_subjects', (SELECT COUNT(DISTINCT data_subject_id) FROM personal_data WHERE retention_until < CURDATE()),
    'upcoming_expirations', (
        SELECT JSON_ARRAYAGG(
            JSON_OBJECT(
                'subject_id', data_subject_id,
                'expires_on', retention_until,
                'days_remaining', DATEDIFF(retention_until, CURDATE())
            )
        )
        FROM personal_data 
        WHERE retention_until BETWEEN CURDATE() AND DATE_ADD(CURDATE(), INTERVAL 30 DAY)
    )
) AS retention_report;
SQL

log_message "📊 Retention report generated: $REPORT_FILE"
EOF

sudo chmod +x /usr/local/bin/gdpr-retention-cleanup

# Set up cron job for daily retention cleanup
echo "0 2 * * * /usr/local/bin/gdpr-retention-cleanup false" | sudo crontab -

Example 2: Consent Management System

# Create consent management utilities
cat > /usr/local/bin/gdpr-consent-manager << 'EOF'
#!/bin/bash
# GDPR Consent Management System

set -euo pipefail

ACTION="$1"
SUBJECT_ID="$2"
PURPOSE="$3"
CONSENT="${4:-}"

case $ACTION in
    "record")
        # Record new consent
        mysql -u gdpr_processor -p'ProcessorPass456!' gdpr_compliance << SQL
        INSERT INTO consent_records (data_subject_id, purpose, consent_given, consent_method) 
        VALUES ('${SUBJECT_ID}', '${PURPOSE}', ${CONSENT}, 'cli_tool');
        
        INSERT INTO audit_log (action, data_subject_id, user_id, details) 
        VALUES (
            'CONSENT_RECORDED', 
            '${SUBJECT_ID}', 
            USER(), 
            JSON_OBJECT('purpose', '${PURPOSE}', 'consent', ${CONSENT})
        );
SQL
        echo "✅ Consent recorded for $SUBJECT_ID - Purpose: $PURPOSE - Consent: $CONSENT"
        ;;
        
    "withdraw")
        # Withdraw consent
        mysql -u gdpr_processor -p'ProcessorPass456!' gdpr_compliance << SQL
        UPDATE consent_records 
        SET consent_given = false, withdrawn_date = NOW() 
        WHERE data_subject_id = '${SUBJECT_ID}' AND purpose = '${PURPOSE}' AND consent_given = true;
        
        INSERT INTO audit_log (action, data_subject_id, user_id, details) 
        VALUES (
            'CONSENT_WITHDRAWN', 
            '${SUBJECT_ID}', 
            USER(), 
            JSON_OBJECT('purpose', '${PURPOSE}')
        );
SQL
        echo "✅ Consent withdrawn for $SUBJECT_ID - Purpose: $PURPOSE"
        ;;
        
    "check")
        # Check consent status
        mysql -u gdpr_processor -p'ProcessorPass456!' gdpr_compliance << SQL
        SELECT 
            purpose,
            consent_given,
            consent_date,
            withdrawn_date,
            consent_method
        FROM consent_records 
        WHERE data_subject_id = '${SUBJECT_ID}'
        ORDER BY consent_date DESC;
SQL
        ;;
        
    *)
        echo "Usage: $0 {record|withdraw|check} <subject_id> <purpose> [consent_true/false]"
        exit 1
        ;;
esac
EOF

sudo chmod +x /usr/local/bin/gdpr-consent-manager

Example 3: Privacy Impact Assessment

# Create Privacy Impact Assessment template
cat > /etc/gdpr-compliance/documentation/pia-template.md << 'EOF'
# Privacy Impact Assessment (PIA) Template

## 1. Project Information
- **Project Name**: [Name of system/process]
- **Project Manager**: [Name and contact]
- **Date**: [Assessment date]
- **Review Date**: [Next review date]

## 2. Data Processing Description
- **What personal data is collected?**
- **Why is it collected?**
- **How is it collected?**
- **Where is it stored?**
- **Who has access?**
- **How long is it retained?**

## 3. Legal Basis Assessment
- [ ] Consent (Article 6(1)(a))
- [ ] Contract (Article 6(1)(b))
- [ ] Legal obligation (Article 6(1)(c))
- [ ] Vital interests (Article 6(1)(d))
- [ ] Public task (Article 6(1)(e))
- [ ] Legitimate interests (Article 6(1)(f))

## 4. Risk Assessment
### High Risks Identified:
- [ ] Large-scale processing
- [ ] Systematic monitoring
- [ ] Sensitive data processing
- [ ] Vulnerable data subjects
- [ ] Innovative technology
- [ ] Cross-border transfers
- [ ] Automated decision-making

### Risk Mitigation Measures:
1. **Technical measures**:
   - Encryption at rest and in transit
   - Access controls and authentication
   - Regular security audits
   - Data anonymization/pseudonymization

2. **Organizational measures**:
   - Staff training on data protection
   - Clear policies and procedures
   - Regular compliance reviews
   - Incident response procedures

## 5. Data Subject Rights Implementation
- [ ] Information provision (Articles 13-14)
- [ ] Right of access (Article 15)
- [ ] Right to rectification (Article 16)
- [ ] Right to erasure (Article 17)
- [ ] Right to restrict processing (Article 18)
- [ ] Right to data portability (Article 20)
- [ ] Right to object (Article 21)

## 6. Data Transfers
- **Are there any international transfers?** [Yes/No]
- **If yes, what safeguards are in place?**
  - [ ] Adequacy decision
  - [ ] Standard Contractual Clauses
  - [ ] Binding Corporate Rules
  - [ ] Certification scheme

## 7. Conclusion and Recommendations
- **Overall risk level**: [Low/Medium/High]
- **Recommendations for risk mitigation**:
- **Action plan with deadlines**:
- **Monitoring and review schedule**:

## 8. Approval
- **DPO Review**: [Name and date]
- **Management Approval**: [Name and date]
- **Implementation Status**: [Planned/In Progress/Complete]
EOF

🚨 Fix Common Problems

Encountering GDPR compliance issues? Here are solutions:

Problem 1: Data Discovery and Mapping

# Create data discovery script
cat > /usr/local/bin/gdpr-data-discovery << 'EOF'
#!/bin/bash
# Discover and map personal data across the system

echo "🔍 GDPR Data Discovery Process"

# Check databases for potential personal data
echo "📊 Scanning databases..."
mysql -u gdpr_auditor -p'AuditorPass789!' -e "SHOW DATABASES;" | grep -v "information_schema\|performance_schema\|mysql" | while read db; do
    echo "Database: $db"
    mysql -u gdpr_auditor -p'AuditorPass789!' "$db" -e "SHOW TABLES;" | while read table; do
        echo "  Table: $table"
        # Look for columns that might contain personal data
        mysql -u gdpr_auditor -p'AuditorPass789!' "$db" -e "DESCRIBE $table;" | grep -i -E "(email|name|phone|address|ssn|id)" | while read column; do
            echo "    Potential PII: $column"
        done
    done
done

# Check log files for personal data
echo "📝 Scanning log files..."
find /var/log -name "*.log" -type f | while read logfile; do
    if grep -q -E "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b" "$logfile" 2>/dev/null; then
        echo "⚠️  Potential email addresses found in: $logfile"
    fi
done

# Check application directories
echo "📁 Scanning application data..."
find /opt /var/www -name "*.json" -o -name "*.xml" -o -name "*.csv" | head -20 | while read datafile; do
    if [[ -r "$datafile" ]]; then
        if grep -q -E "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b" "$datafile" 2>/dev/null; then
            echo "⚠️  Potential personal data in: $datafile"
        fi
    fi
done

echo "✅ Data discovery completed. Review results and update data inventory."
EOF

sudo chmod +x /usr/local/bin/gdpr-data-discovery

Problem 2: Breach Detection and Response

# Create breach detection system
cat > /usr/local/bin/gdpr-breach-detector << 'EOF'
#!/bin/bash
# GDPR Breach Detection and Response System

set -euo pipefail

BREACH_LOG="/var/log/gdpr-compliance/breach.log"
ALERT_EMAIL="[email protected]"

log_breach() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - BREACH DETECTED: $1" | tee -a "$BREACH_LOG"
}

send_alert() {
    log_breach "$1"
    # Send email alert (configure mail system first)
    echo "GDPR BREACH ALERT: $1" | mail -s "URGENT: Data Breach Detected" "$ALERT_EMAIL"
}

# Monitor for suspicious database access
check_database_access() {
    # Look for unusual access patterns in the last hour
    SUSPICIOUS_QUERIES=$(mysql -u gdpr_auditor -p'AuditorPass789!' gdpr_compliance -N << 'SQL'
SELECT COUNT(*) 
FROM audit_log 
WHERE timestamp > DATE_SUB(NOW(), INTERVAL 1 HOUR)
  AND action = 'DATA_EXPORT'
  AND user_id NOT LIKE '%gdpr_%';
SQL
)

    if [[ "$SUSPICIOUS_QUERIES" -gt 10 ]]; then
        send_alert "Unusual database access pattern detected: $SUSPICIOUS_QUERIES unauthorized exports in last hour"
    fi
}

# Monitor for bulk data access
check_bulk_access() {
    BULK_ACCESS=$(mysql -u gdpr_auditor -p'AuditorPass789!' gdpr_compliance -N << 'SQL'
SELECT COUNT(DISTINCT data_subject_id) 
FROM data_access_log 
WHERE timestamp > DATE_SUB(NOW(), INTERVAL 10 MINUTE)
  AND accessed_by NOT LIKE '%gdpr_%';
SQL
)

    if [[ "$BULK_ACCESS" -gt 100 ]]; then
        send_alert "Bulk data access detected: $BULK_ACCESS subjects accessed in 10 minutes"
    fi
}

# Check for failed login attempts
check_failed_logins() {
    FAILED_LOGINS=$(journalctl --since "10 minutes ago" | grep -c "authentication failure" || echo "0")
    
    if [[ "$FAILED_LOGINS" -gt 20 ]]; then
        send_alert "High number of failed login attempts: $FAILED_LOGINS in last 10 minutes"
    fi
}

# Monitor file system access to encrypted data
check_encrypted_access() {
    if [[ -d "/mnt/gdpr-secure-data" ]]; then
        RECENT_ACCESS=$(find /mnt/gdpr-secure-data -type f -amin -10 | wc -l)
        if [[ "$RECENT_ACCESS" -gt 50 ]]; then
            send_alert "Unusual access to encrypted data: $RECENT_ACCESS files accessed in last 10 minutes"
        fi
    fi
}

# Run all checks
check_database_access
check_bulk_access
check_failed_logins
check_encrypted_access

echo "✅ Breach detection checks completed at $(date)"
EOF

sudo chmod +x /usr/local/bin/gdpr-breach-detector

# Set up regular breach monitoring
echo "*/10 * * * * /usr/local/bin/gdpr-breach-detector" | sudo crontab -u root -

Problem 3: Cross-Border Data Transfer Compliance

# Create data transfer compliance checker
cat > /usr/local/bin/gdpr-transfer-compliance << 'EOF'
#!/bin/bash
# Check compliance for cross-border data transfers

set -euo pipefail

echo "🌍 GDPR Cross-Border Transfer Compliance Check"

# List of countries with adequacy decisions (as of 2023)
ADEQUATE_COUNTRIES=("Andorra" "Argentina" "Canada" "Faroe Islands" "Guernsey" "Israel" "Isle of Man" "Japan" "Jersey" "New Zealand" "South Korea" "Switzerland" "United Kingdom" "Uruguay")

check_transfer_destination() {
    local destination="$1"
    local adequate=false
    
    for country in "${ADEQUATE_COUNTRIES[@]}"; do
        if [[ "$country" == "$destination" ]]; then
            adequate=true
            break
        fi
    done
    
    if [[ "$adequate" == true ]]; then
        echo "✅ $destination has an adequacy decision - transfer allowed"
    else
        echo "⚠️  $destination lacks adequacy decision - additional safeguards required:"
        echo "   - Standard Contractual Clauses (SCCs)"
        echo "   - Binding Corporate Rules (BCRs)"  
        echo "   - Certification scheme"
        echo "   - Approved code of conduct"
    fi
}

# Check if there are any configured transfers
echo "📊 Checking configured data transfers..."

# Example: Check backup destinations, CDN locations, etc.
if [[ -f "/etc/backup-destinations.conf" ]]; then
    while IFS= read -r destination; do
        echo "Backup destination: $destination"
        check_transfer_destination "$destination"
    done < "/etc/backup-destinations.conf"
fi

# Check for cloud service providers
echo "☁️  Checking cloud service configurations..."

# AWS regions
if command -v aws &> /dev/null; then
    AWS_REGION=$(aws configure get region 2>/dev/null || echo "not-configured")
    if [[ "$AWS_REGION" != "not-configured" ]]; then
        echo "AWS region: $AWS_REGION"
        case $AWS_REGION in
            eu-*) echo "✅ EU region - no cross-border transfer" ;;
            *) echo "⚠️  Non-EU region - verify Data Processing Agreement with AWS" ;;
        esac
    fi
fi

# Generate transfer compliance report
REPORT_FILE="/var/log/gdpr-compliance/transfer-compliance-$(date +%Y%m%d).json"
cat > "$REPORT_FILE" << EOF
{
    "assessment_date": "$(date -I)",
    "adequate_countries": $(printf '%s\n' "${ADEQUATE_COUNTRIES[@]}" | jq -R . | jq -s .),
    "recommendations": [
        "Maintain inventory of all cross-border transfers",
        "Implement appropriate safeguards for non-adequate countries",
        "Regularly review adequacy decisions for changes",
        "Document legal basis for each transfer",
        "Conduct Transfer Impact Assessments where required"
    ]
}
EOF

echo "📊 Transfer compliance report: $REPORT_FILE"
EOF

sudo chmod +x /usr/local/bin/gdpr-transfer-compliance

📋 Simple Commands Summary

Here’s your GDPR compliance quick reference! 📖

💡 Tips for Success

Follow these best practices for GDPR compliance success! 🌟

⚖️ Legal Foundation First

• Get legal advice for your specific situation
• Understand your role (controller vs processor)
• Document your legal basis for processing
• Keep up with regulatory changes

🔒 Privacy by Design

• Build privacy into systems from the start
• Use pseudonymization where possible
• Implement data minimization principles
• Default to most privacy-friendly settings

📊 Comprehensive Documentation

• Maintain detailed processing records
• Document all technical and organizational measures
• Keep evidence of compliance efforts
• Regular compliance assessments

🚨 Incident Preparedness

• Have breach response procedures ready
• Practice incident response scenarios
• Maintain contact lists for authorities
• Pre-draft breach notification templates

👥 Staff Training and Awareness

• Regular GDPR training for all staff
• Specific training for data handlers
• Clear escalation procedures
• Privacy awareness campaigns

🔄 Continuous Monitoring

• Regular compliance audits
• Automated monitoring where possible
• Review and update procedures regularly
• Stay informed about enforcement trends

🏆 What You Learned

Congratulations! You’ve mastered GDPR compliance on AlmaLinux! 🎉 Here’s what you accomplished:

✅ Implemented comprehensive data encryption for personal data protection
✅ Created access control systems with role-based permissions
✅ Built data subject rights systems for access, deletion, and portability
✅ Established audit logging for compliance demonstration
✅ Implemented retention policies with automated cleanup
✅ Created breach detection systems for rapid response
✅ Documented compliance procedures for organizational use
✅ Built monitoring systems for ongoing compliance assurance

🎯 Why This Matters

GDPR compliance isn’t just about avoiding fines - it’s about building trust, respecting privacy, and creating sustainable business practices in the digital age! 🌟

In today’s data-driven world, privacy is a fundamental right and a competitive advantage. Organizations that embrace privacy-by-design don’t just comply with regulations - they build stronger relationships with customers, reduce security risks, and create more resilient business models.

By mastering GDPR compliance on AlmaLinux, you’re not just meeting legal requirements - you’re becoming part of the global movement toward responsible data handling that puts people first. These skills are increasingly valuable as privacy regulations expand worldwide! 🚀

Remember: GDPR compliance is a journey, not a destination. Technology evolves, regulations change, and best practices improve. Stay curious, keep learning, and always put privacy and security at the heart of everything you build! ⭐

Great job on completing this comprehensive GDPR compliance guide! You’re now equipped to build privacy-respecting systems that protect personal data and meet the highest regulatory standards! 🙌