General Data Protection Regulation — rights of data subjects, lawful basis, minimisation, erasure, portability.
Every processing operation rests on a documented lawful basis (Art. 6).
Only data strictly necessary for the declared purpose is retained (Art. 5.1.c).
Data subjects can obtain a full export of their data within 30 days (Art. 15).
Data subjects can request deletion with cryptographic proof of erasure (Art. 17).
Data is exportable in a structured, commonly used, machine-readable format (Art. 20).
Data breaches are notified to the supervisory authority within 72h (Art. 33).
Data is kept only as long as necessary. Default: 24 months for conversational data, 12 months for metadata.