micsapp Gamma Data Handling
Contents
Overview
Implement proper data handling, privacy controls, and GDPR/CCPA compliance for Gamma integrations.
Prerequisites
- Understanding of data privacy regulations (GDPR, CCPA)
- Data classification policies defined
- Legal/compliance team consultation
Data Classification
| Type | Classification | Retention | Handling |
|---|---|---|---|
| Presentation content | User data | User-controlled | Encrypted at rest |
| AI-generated text | Derived data | With source | Standard |
| User prompts | PII potential | 30 days | Anonymize logs |
| Export files | User data | 24 hours cache | Auto-delete |
Instructions
Step 1: Implement Consent Management
Check user consent before Gamma operations. Require explicit consent for data processing and AI analysis separately.
Step 2: Configure PII Handling
Mask emails, hash names, and remove sensitive fields before logging. Never log raw PII in production.
Step 3: Enforce Retention Policies
Auto-delete exports (1 day), anonymize prompts (30 days), archive logs (90 days), delete presentations (365 days). Schedule daily enforcement.
Step 4: Handle GDPR Requests
- Access: Gather all user data including Gamma-stored presentations
- Erasure: Delete from local DB and Gamma API, anonymize user record
Step 5: Enable Audit Trail
Log all significant actions (create, update, delete, share, export) with user ID, IP, timestamp, and resource details.
See detailed implementation for consent management, PII sanitization, retention enforcement, GDPR request handlers, and audit trail code.
Output
- Consent management enforced before operations
- PII sanitized in all logs
- Retention policies running daily
- GDPR access/erasure requests handled
- Audit trail recording all actions
Error Handling
| Error | Cause | Solution |
|---|---|---|
| Consent not obtained | New user flow | Add consent gate before first operation |
| Deletion incomplete | Gamma API timeout | Retry with exponential backoff |
| Audit gap | Missing log entry | Add audit middleware to all routes |
| Retention not running | Scheduler stopped | Monitor cron job health |
Examples
Compliance Checklist
- Data processing agreement with Gamma signed
- User consent mechanism implemented
- PII handling procedures documented
- Data retention policies enforced
- GDPR rights request process ready
- Audit logging enabled
Resources
Next Steps
Proceed to gamma-enterprise-rbac for access control.