Data privacy and compliance (GDPR) in HLD - Scalability & System Analysis

Scalability Analysis - Data privacy and compliance (GDPR)

Growth Table: Data Privacy & GDPR Compliance Scaling

Users	Data Volume	Compliance Effort	System Impact	Audit & Reporting
100 users	Low (MBs)	Basic consent & data handling	Manual reviews possible	Simple logs, manual audits
10,000 users	Medium (GBs)	Automated consent management	Partial automation for data requests	Automated logging, periodic audits
1,000,000 users	High (TBs)	Full automation: consent, erasure, portability	Scalable data access controls, encryption	Continuous monitoring, compliance dashboards
100,000,000 users	Very High (PBs)	Distributed compliance enforcement	Data partitioning, global data residency	Real-time audit, AI-assisted anomaly detection

First Bottleneck

The first bottleneck is the data access and processing layer. As user data grows, handling consent, data subject requests (like erasure or portability), and audit logs in real-time becomes challenging. Without automation, manual processes slow down and risk non-compliance.

Scaling Solutions

• Automation: Implement automated workflows for consent management, data subject requests, and audit logging.
• Data Partitioning: Separate data by region to comply with data residency laws and reduce query scope.
• Encryption & Access Controls: Use strong encryption and role-based access to protect data privacy at scale.
• Distributed Systems: Use distributed databases and microservices to handle large volumes and isolate compliance logic.
• Monitoring & Alerting: Continuous compliance monitoring with dashboards and alerts for anomalies.
• Data Minimization: Store only necessary data to reduce risk and storage costs.

Back-of-Envelope Cost Analysis

• Requests: Handling 1M users with 1 request/day for data access = ~11.5 QPS (manageable by a few servers).
• Storage: 1M users x 1GB/user = ~1PB data; requires scalable storage with encryption overhead.
• Bandwidth: Data subject requests (e.g., data export) can spike bandwidth; plan for peak loads with CDN or throttling.
• Audit Logs: Continuous logging can generate millions of entries daily; use log aggregation and retention policies.

Interview Tip

Structure your discussion by first identifying compliance requirements (consent, data subject rights, audit). Then analyze how these scale with users and data volume. Highlight bottlenecks in data processing and automation. Finally, propose practical solutions like automation, encryption, and monitoring. Emphasize risk mitigation and legal impact.

Self Check

Your database handles 1000 QPS for user data queries. Traffic grows 10x due to GDPR data access requests. What do you do first?

Answer: Implement caching and read replicas to reduce database load and speed up data access. Also, automate request handling to batch or throttle queries, preventing overload and ensuring compliance.

Key Result

Data privacy compliance systems first break at data access and processing layers as user data and requests grow. Automating consent and data subject requests, partitioning data, and strong encryption are key to scaling safely.

Practice

1. What is the main purpose of GDPR in system design?

easy

A. To reduce server costs by deleting all user data immediately

B. To protect user privacy and ensure data is handled responsibly

C. To allow unlimited data collection for marketing

D. To increase system performance by caching user data

Solution

1. Step 1: Understand GDPR's goal

   GDPR aims to protect personal data and privacy of users in the EU.

2. Step 2: Match purpose to options

   Only To protect user privacy and ensure data is handled responsibly mentions protecting privacy and responsible data handling, which aligns with GDPR.

3. Final Answer:

   To protect user privacy and ensure data is handled responsibly -> Option B

4. Quick Check:

   GDPR = Protect privacy [OK]

Hint: GDPR = user privacy protection [OK]

Common Mistakes:

• Confusing GDPR with performance or cost goals
• Thinking GDPR allows unlimited data collection
• Ignoring privacy as the core focus

2. Which of the following is a correct way to obtain user consent under GDPR?

easy

A. Collecting data first, then asking for consent later

B. Pre-checked boxes that users can uncheck anytime

C. Assuming consent if the user visits the website

D. Clear opt-in with explicit user action before data collection

Solution

1. Step 1: Review GDPR consent rules

   Consent must be freely given, specific, informed, and unambiguous with clear user action.

2. Step 2: Evaluate options

   Only Clear opt-in with explicit user action before data collection describes explicit opt-in before data collection, which is GDPR compliant.

3. Final Answer:

   Clear opt-in with explicit user action before data collection -> Option D

4. Quick Check:

   Consent = explicit opt-in [OK]

Hint: Consent requires clear opt-in, not assumptions [OK]

Common Mistakes:

• Using pre-checked boxes as valid consent
• Assuming visiting equals consent
• Collecting data before consent

3. Consider a system that stores user data with a 'right to be forgotten' feature. Which action correctly implements this under GDPR?

def delete_user_data(user_id):
    # Step 1: Mark user data as deleted
    database.mark_deleted(user_id)
    # Step 2: Remove data from active systems
    cache.remove(user_id)
    # Step 3: Permanently erase data after retention period
    schedule_permanent_delete(user_id, days=30)

medium

A. This implementation violates GDPR because data is not deleted immediately

B. This implementation is incorrect because it does not notify the user

C. This implementation respects GDPR by delaying permanent deletion for 30 days

D. This implementation is incorrect because it does not encrypt user data

Solution

1. Step 1: Understand GDPR's 'right to be forgotten'

   GDPR allows data to be deleted but permits a retention period for legal or operational reasons.

2. Step 2: Analyze code steps

   Data is marked deleted, removed from active use, and scheduled for permanent erase after 30 days, which is acceptable.

3. Final Answer:

   This implementation respects GDPR by delaying permanent deletion for 30 days -> Option C

4. Quick Check:

   Right to be forgotten allows retention delay [OK]

Hint: Deletion can be delayed for legal retention [OK]

Common Mistakes:

• Expecting immediate permanent deletion always
• Confusing notification with deletion requirements
• Thinking encryption replaces deletion

4. A system logs user IP addresses without anonymization. Which GDPR compliance issue does this cause?

log_user_access(user_id, ip_address):
    logs.save({'user': user_id, 'ip': ip_address, 'time': now()})

medium

A. It violates data minimization by storing unnecessary personal data

B. It violates consent because IP addresses are not encrypted

C. It violates breach notification rules by logging IPs

D. It violates data portability by not exporting IP addresses

Solution

1. Step 1: Identify GDPR principles involved

   Data minimization requires only collecting data necessary for the purpose.

2. Step 2: Analyze IP logging

   Storing full IP addresses without anonymization may be unnecessary and excessive, violating minimization.

3. Final Answer:

   It violates data minimization by storing unnecessary personal data -> Option A

4. Quick Check:

   Data minimization = minimal necessary data [OK]

Hint: Store only data you really need [OK]

Common Mistakes:

• Confusing encryption with consent
• Mixing breach notification with logging
• Thinking data portability applies here

5. You are designing a system to comply with GDPR. Which combination of features best supports compliance?

• 1. Data encryption at rest and in transit
• 2. User consent management with audit logs
• 3. Automatic data deletion after user request
• 4. Collecting all user data for analytics without opt-out

hard

A. Features 1, 2, and 3 only

B. Features 2 and 4 only

C. Features 1 and 4 only

D. All features 1, 2, 3, and 4

Solution

1. Step 1: Evaluate each feature for GDPR compliance

   Feature 1 (encryption) protects data; Feature 2 manages consent properly; Feature 3 respects user deletion rights; Feature 4 violates consent and data minimization.

2. Step 2: Select compliant combination

   Only features 1, 2, and 3 together support GDPR compliance fully.

3. Final Answer:

   Features 1, 2, and 3 only -> Option A

4. Quick Check:

   Consent + encryption + deletion = GDPR compliance [OK]

Hint: Exclude features violating consent or data minimization [OK]

Common Mistakes:

• Including data collection without opt-out
• Ignoring encryption importance
• Overlooking user deletion rights