PII & Privacy Regulations Skill

PII & Privacy Regulations Skill

Handling personally identifiable information under European and Australian privacy regulations.

⚠️ Staleness Warning

Privacy regulations are actively evolving. Major changes expected.

Refresh triggers:

• GDPR enforcement updates or new guidelines
• Australian Privacy Act reform (ongoing review)
• New adequacy decisions for data transfers
• Significant enforcement actions or fines
• EU AI Act privacy provisions (2025-2026)

Last validated: February 2026

Check current state:

• EU: GDPR.eu, EU Commission
• Australia: OAIC

What is PII?

Personally Identifiable Information (PII) is any data that can identify an individual directly or indirectly.

Direct Identifiers

Indirect Identifiers (Quasi-identifiers)

Key insight: Combining quasi-identifiers can uniquely identify individuals even without direct identifiers.

🇪🇺 GDPR (European Union)

Applies to: Any organization processing EU residents' data, regardless of location.

Core Principles (Article 5)

Lawful Bases for Processing

Individual Rights (Data Subject Rights)

GDPR Compliance Checklist

## Lawful Basis & Transparency
- [ ] Document lawful basis for each processing activity
- [ ] Maintain records of processing activities (Article 30)
- [ ] Privacy policy is clear, accessible, updated

## Data Security
- [ ] Encryption at rest and in transit
- [ ] Pseudonymization where possible
- [ ] Data Protection Impact Assessment (DPIA) for high-risk processing
- [ ] Breach notification process (72 hours to authority)

## Governance
- [ ] Data Protection Officer (DPO) appointed if required
- [ ] Data Processing Agreements with third parties
- [ ] EU representative appointed (if outside EU)

## Individual Rights
- [ ] Process to handle access requests
- [ ] Process to handle deletion requests
- [ ] Process to handle data portability requests
- [ ] Consent mechanism (opt-in, not opt-out)

2025-2026 Updates

🇦🇺 Australian Privacy Principles (APPs)

Applies to: Organizations with annual turnover >$3M AUD, government agencies, health service providers, and some others.

The 13 APPs

Sensitive Information (Higher Protection)

Under Australian law, sensitive information includes:

• Health information
• Genetic information
• Biometric data
• Racial or ethnic origin
• Political opinions
• Religious beliefs
• Sexual orientation
• Criminal record
• Trade union membership

Rule: Sensitive information generally requires consent to collect.

Notifiable Data Breaches (NDB) Scheme

When to notify:

• Unauthorized access, disclosure, or loss of personal information
• Likely to result in serious harm to individuals
• Remedial action hasn't prevented serious harm

Timeline:

• Notify OAIC and affected individuals as soon as practicable
• Assessment must be completed within 30 days

Australian Privacy Act Reform (Ongoing)

The Privacy Act is under review. Expected changes:

Cross-Jurisdictional Comparison

Code Implementation Patterns

Never Log PII

// ❌ BAD
logger.info(`User ${user.email} logged in from ${user.ipAddress}`);

// ✅ GOOD
logger.info(`User ${hashUserId(user.id)} logged in`);

Encrypt PII at Rest

// Encrypt before storing
const encryptedEmail = encrypt(user.email, encryptionKey);
await db.users.update({ id: user.id, email: encryptedEmail });

// Decrypt only when needed
const email = decrypt(storedUser.email, encryptionKey);

Implement Data Minimization

// ❌ BAD - Fetching everything
const user = await db.users.findById(id);
return user; // Contains PII you don't need

// ✅ GOOD - Select only needed fields
const user = await db.users.findById(id, {
  select: ['id', 'displayName', 'preferences']
});
return user;

Consent Management

interface ConsentRecord {
  userId: string;
  purpose: 'marketing' | 'analytics' | 'personalization';
  granted: boolean;
  timestamp: Date;
  source: 'web' | 'mobile' | 'api';
  version: string; // Privacy policy version
}

// Always check consent before processing
async function canProcess(userId: string, purpose: string): Promise<boolean> {
  const consent = await getLatestConsent(userId, purpose);
  return consent?.granted === true;
}

Data Subject Request Handler

interface DataSubjectRequest {
  type: 'access' | 'rectification' | 'erasure' | 'portability' | 'objection';
  userId: string;
  requestedAt: Date;
  deadline: Date; // 30 days for GDPR
  status: 'pending' | 'processing' | 'completed' | 'denied';
}

// Implement audit trail for all requests
async function handleDSR(request: DataSubjectRequest) {
  await auditLog.record({
    action: 'dsr_received',
    requestType: request.type,
    userId: request.userId,
    timestamp: new Date()
  });

  // Process based on type...
}

Pseudonymization Pattern

// Replace direct identifiers with tokens
function pseudonymize(record: UserRecord): PseudonymizedRecord {
  return {
    pseudoId: generateToken(record.id), // Reversible with key
    ageGroup: getAgeGroup(record.birthDate), // 18-25, 26-35, etc.
    region: record.country, // Keep general location
    // Omit: name, email, exact address, etc.
  };
}

Compliance Checklist

For New Projects

## Privacy Impact Assessment
- [ ] What PII will be collected?
- [ ] What is the lawful basis (GDPR) / primary purpose (APP)?
- [ ] Is all collected data necessary? (data minimization)
- [ ] How long will data be retained?
- [ ] Who will have access?
- [ ] Will data cross borders?
- [ ] What security measures are in place?

## Technical Implementation
- [ ] PII encrypted at rest
- [ ] PII encrypted in transit (TLS 1.2+)
- [ ] Logging excludes PII
- [ ] Consent captured before processing
- [ ] Data subject request endpoints implemented
- [ ] Retention/deletion automation in place
- [ ] Audit logging for PII access

Quick Reference: When Processing is Prohibited

Resources

Official

• GDPR Full Text
• EU Commission Data Protection
• OAIC Australian Privacy Principles
• OAIC Privacy Act

Tools

• Data Protection Impact Assessment templates
• Consent management platforms
• Data discovery and classification tools

Synapses

See synapses.json for connections.