Privacy engineering

Privacy Engineering

Ortak Doktrin

agents/shared/severity-rubric.md ve agents/shared/escalation-matrix.md default-load sayılır (agents/coordination.md §11). Bu skill'in çıktısı Critical / High / Medium / Low + kanıt formatında olmak zorunda — spekülatif Critical yasak. Sahiplik dışı bulgu ilgili agent'a delege; karar yetkisi eşiği aşılırsa kullanıcı onayı zorunlu.

Felsefe

• Privacy by design. Default-private; opt-in.
• PII = first-class. Schema/log/event işaretlenmiş.
• DSR otomatik. Manuel grep SLA kaçırır.
• Pseudonymization > anonymization. KMS pepper + ayrı lookup.
• Retention = expire. Aktif olmayan veri silinir / arşive.
• Consent audit. Kanıtlanabilir.
• DPIA new-feature gate. Yüksek risk öncesi.

Ne Zaman Kullanılır

• Yeni feature PII topluyor
• DSR otomasyon kurulum / iyileştirme
• Audit (GDPR/KVKK/CCPA) öncesi privacy gap
• Data breach blast radius değerlendirme
• Vendor / sub-processor DPA yenileme
• Cross-border transfer SCC review
• Children / age-gate
• Profiling / automated decision opt-out
• Log PII redact kanıt
• Pseudonymization mimari / pepper rotation

Workflow

1) PII discovery & inventory

# DB schema scan
psql -c "
  select table_name, column_name, data_type
  from information_schema.columns
  where column_name ~* 'email|phone|name|address|birth|ssn|tckn|iban|card|password'
  order by table_name, column_name;
"

# Code scan (TypeScript / Python)
rg -i "pii|personaldata|sensitive|gdpr" src/ --type ts
rg -i "email|phone|ssn" --type py src/

# Log audit
kubectl logs -n production deploy/api-svc --tail=10000 | \
  jq 'select(.email != null or .phone != null)' | head

data-catalog/<table>.yaml:

table: users
owner: "@auth-team"
classification:
  - { column: email, pii_type: direct_identifier, sensitivity: high, retention_days: 1095, pseudonymize: true }
  - { column: phone_e164, pii_type: direct_identifier, sensitivity: high, retention_days: 1095 }
  - { column: birth_date, pii_type: quasi_identifier, sensitivity: medium, retention_days: 730 }
  - { column: password_hash, pii_type: auth_secret, sensitivity: critical, retention_days: -1 }

CI gate: schema migration ↔ data-catalog drift PR red.

2) Data flow map

DFD'de PII edge işaretle (threat-model skill ile bağlı). Her PII edge bir asset; sub-processor edge'i SCC kontrolü gerek.

3) Consent

event: consent_granted | consent_withdrawn
properties:
  user_id: ...
  purpose: marketing | analytics | personalization | functional
  legal_basis: consent | contract | legitimate_interest
  policy_version: ...
  consent_method: explicit_optin | granted_at_signup
  timestamp: ...
  ip_address: hashed
  user_agent_hash: ...

Withdraw ≡ grant tek tık (GDPR Art. 7).

4) DSR automation

/api/dsr/access + /api/dsr/erasure + /api/dsr/portability:

# erasure worker
def erase_user(user_id: str, idempotency_key: str) -> ErasureReceipt:
    with audit_log(user_id, "erasure", idempotency_key):
        # 1. Soft delete
        db.execute("update users set deleted_at = now() where id = :id", id=user_id)
        # 2. PII nullify (cascade)
        db.execute("""
          update users set
            email = null, name = null, phone = null, address = null
          where id = :id
        """, id=user_id)
        db.execute("""
          update orders set
            shipping_address = null, billing_email = null
          where user_id = :id
        """, id=user_id)
        # 3. Vendor DSR (Stripe, Intercom, Segment, Mailchimp)
        for vendor in active_vendors():
            vendor.dsr_erasure(user_id)
        # 4. Warehouse pseudonym
        warehouse.exec("update events_fact set raw_email = null where user_hash = :h",
                       h=pseudo(user_id))
        # 5. Backup purge schedule (30g delay)
        schedule_backup_purge(user_id, delay_days=30)
    return ErasureReceipt(id=evidence_id, completed_at=now())

SLA tracker:

select id, submitted_at, sla_deadline,
  case when sla_deadline < now() and completed_at is null then 'BREACH'
       when sla_deadline < now() + interval '5 days' and completed_at is null then 'AT_RISK'
       else 'OK' end as status
from dsr_requests
where completed_at is null;

T+25 günde alarm.

5) Retention

defaults:
  inactive_user_data: 730_days_then_archive
  authentication_logs: 90_days
  marketing_events: 365_days
  audit_logs: 2555_days
  payment_records: 2555_days
overrides:
  - { table: users, column: email, retention_days: 1095 }
  - { table: orders, retention_days: 2555 }
  - { table: clickstream, retention_days: 90 }

Enforcer (nightly K8s CronJob):

apiVersion: batch/v1
kind: CronJob
metadata: { name: retention-enforcer }
spec:
  schedule: "0 3 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
            - name: enforcer
              image: privacy-tools:1.0
              command: ["python", "enforce_retention.py"]
              envFrom: [{ secretRef: { name: db-credentials } }]
          restartPolicy: OnFailure

6) Pseudonymization

import hmac, hashlib, os
PEPPER = os.environ["PII_PEPPER"]   # KMS-managed; 90g rotate

def pseudo(value: str) -> str:
    return hmac.new(PEPPER.encode(), value.lower().strip().encode(), hashlib.sha256).hexdigest()

Pepper rotation: dual-pepper 7g (eski + yeni accept), eski rotate. Lookup table ayrı pseudo_lookup schema; production app erişmez (DSR worker erişir, audit log).

7) Log PII redact

PII_FIELDS = {'email', 'phone', 'card_pan', 'password', 'ssn', 'iban',
              'tckn', 'address', 'first_name', 'last_name'}

def redact(rec: dict) -> dict:
    for k, v in list(rec.items()):
        if k.lower() in PII_FIELDS:
            rec[k] = '<redacted>'
    return rec

logger.add_filter(redact)

CI test (synthetic log replay):

def test_log_no_pii():
    log = simulate_request(email="[email protected]")
    assert "[email protected]" not in log
    assert "<redacted>" in log

8) DPIA gate

templates/privacy/dpia.md doldur; DPO sign-off olmadan ship yok.

Tetik:

• Special category (sağlık, biometric, race, religion, sexuality)
• Profiling / automated decision
• Geniş çapta takip
• Çocuk verisi
• Cross-border yeni transfer

9) Vendor / sub-processor

# sub-processors.yaml
- name: Stripe
  purpose: payment_processing
  data_shared: [name, email, card_last4]
  region: EU + US
  dpa_signed: 2024-03-15
  dpa_expiry: 2027-03-15
  scc_module: 2021/914_Module_2

Customer-facing render (/privacy/sub-processors sayfası). Expire 60g öncesi alarm.

10) Cross-border transfer

EU → US:

• SCC 2021/914 module 2 (controller-processor)
• TIA (Transfer Impact Assessment)
• Schrems II — supplementary measures (encryption, key in EU)

11) Audit trail

privacy_audit table:

• DSR submission + completion
• Consent grant + withdraw
• Vendor DPA expire / renew
• Pepper rotation
• DPIA approval
• Schema PII change

7 yıl retention.

Checklist

• PII inventory (data-catalog/*.yaml) tüm tablo
• CI gate schema ↔ catalog drift
• Consent event + audit log
• DSR worker (access + erasure + portability)
• DSR SLA tracker + T+25 alarm
• Retention policy YAML + nightly cron
• Pseudonymization pepper KMS + 90g rotate
• Lookup table ayrı sistem
• Log PII redact middleware + CI test
• DPIA template + new-feature gate
• Sub-processor DPA inventory + 60g expire alarm
• Cross-border SCC + TIA
• Child age-gate (13/16)
• Profile / automated decision opt-out endpoint
• Audit trail 7 yıl

Antipattern

• PII inventory yok.
• Marketing scope creep.
• Log PII plaintext.
• Consent log yok.
• Manuel DSR.
• Retention yok.
• Backup DSR ihlal.
• Pseudonym pepper repo.
• DPIA yok high-risk.
• Child age gate yok.
• SaaS DPA imzasız.
• Cross-border SCC yok.
• Profile opt-out yok.

Çıktı Formatı

# Privacy Engineering Review: <feature | service | quarterly>

## PII Inventory (data-catalog)
| Tablo | Kolon | PII type | Sensitivity | Retention | Pseudonymize |

## Data Flow PII Edges

## Consent
- Event schema
- Withdraw UX

## DSR
- Access / erasure / portability worker
- SLA tracker; current breach + at-risk

## Retention
- Policy YAML
- Enforcer schedule

## Pseudonymization
- Pepper KMS rotation cadence

## DPIA
- Tetik feature listesi

## Sub-processors
- DPA expiry; SCC modüller

## Findings (Critical/High/Medium/Low)

## Action Items
| P | Aksiyon | Sahip | Bitiş | Issue |