---
name: Privacy (GDPR/CCPA)
description: Handle personal data lawfully.
---
# Privacy (GDPR / CCPA)

Privacy law is principles-based: process personal data lawfully, minimally, transparently, and securely. The specific statutes (GDPR, CCPA, and others) operationalize these.

## Core principles (GDPR-flavored, broadly applicable)
- **Lawful basis.** Consent, contract, legitimate interest — name which applies.
- **Data minimization.** Collect only what you need for the stated purpose. "Collect everything in case" violates this.
- **Purpose limitation.** Use data only for the purpose disclosed. Re-purposing needs fresh basis.
- **Transparency.** A privacy notice users can actually read. What you collect, why, with whom you share, how long.
- **Subject rights.** Access, deletion, portability. Build the machinery to fulfill these; the deadline is short.
- **Security.** Reasonable measures — encryption, access control, breach response plan with notification timelines.

## Cross-border
Moving personal data across jurisdictions (EU→US, etc.) needs a lawful mechanism (SCCs, adequacy). Get this wrong and the whole flow is unlawful.