Data Privacy Template for Engineering Teams

No. A DPIA is required under GDPR when processing is likely to result in high risk to individuals. This includes systematic monitoring of public areas, large-scale processing of sensitive data, and automated decision-making with legal effects. For standard product analytics and user management features, a DPIA is usually not required. When in doubt, document why you concluded a DPIA is not needed. The [data classification template](/templates) helps determine the sensitivity level of your data.

AI features raise additional privacy concerns: training data may contain personal information, models may memorize individual data points, and automated decisions may have significant effects on users. Document what personal data is used for training, whether users can opt out of model training, and whether the feature makes automated decisions. The [responsible AI framework](/frameworks/responsible-ai-framework) covers these issues in depth.

Anonymization permanently removes the ability to identify an individual from the data. Truly anonymized data is no longer personal data under GDPR. Pseudonymization replaces identifying fields with tokens or hashes, but the data can be re-identified if you have the key. Pseudonymized data is still personal data under GDPR. Use anonymization for analytics aggregates. Use pseudonymization when you need to re-link data later (e.g. for longitudinal analysis).

Keep data only as long as necessary for the purpose it was collected. Typical retention periods: transactional data (7 years for tax compliance), behavioral analytics (12-24 months then aggregate), marketing consent records (lifetime of the consent plus 3 years), support tickets (3 years from resolution). Define retention per data element, not per system. The [data retention policy template](/templates/data-retention-policy-template) provides a full retention schedule framework.

Legal obligations override the right to erasure. If tax law requires keeping financial records for 7 years, you can retain those records even after a deletion request. However, you must delete all data not covered by a legal obligation, restrict processing of retained data to the legal purpose only, and inform the user which data is retained and why. Document these exceptions in your privacy documentation. ---