Checklist · Data and ML
Data Privacy Checklist for Engineers and Analysts
Opens with creditsA practical checklist for engineers and analysts who store, query, move or share personal data. It covers knowing which rules apply, data inventory and mapping, minimization, PII classification, masking and pseudonymization, retention and deletion, access control, cross-border transfers, logging, vendor sharing and breach readiness. It is general guidance, not legal advice.
Written by Tauseef Fayyaz11 chapters, 40 checksAbout 22 minReviewed 13 October 2026What you will learn
11 chapters · about 22 min
1Scope, roles and purposeBefore any technical control, know which rules apply, what role your organisation plays and why each dataset exists. These checks set the frame for the rest.3 checks · 2 min
2Inventory and data mappingYou cannot protect, delete or report on data you do not know you have. These checks follow the Inventory and Mapping category of the NIST Privacy Framework.4 checks · 2 min
- 1Keep an inventory of every system and dataset that holds personal data
- 2Map how personal data flows between systems, teams, vendors and countries
- 3Support your organisation's records of processing with accurate technical detail
- 4Update the inventory when schemas, pipelines or vendors change
4 in this chapterOpen this chapter- Minimization and purpose limitsData you never collect cannot leak, and data you delete cannot be breached. These checks keep personal data to what each purpose needs.4 checks · 2 minOpens with credits
- PII classificationControls should match how sensitive each field is. These checks label data so access, masking and retention rules can follow automatically.3 checks · 2 minOpens with credits
- Masking, pseudonymization and anonymizationReducing identifiability lowers risk, but it does not take data out of the law. These checks follow the ICO's pseudonymisation guidance and the GDPR's definitions.4 checks · 2 minOpens with credits
- Retention and deletionKeeping personal data forever is a choice with a cost. These checks set retention periods and make deletion actually happen everywhere.4 checks · 2 minOpens with credits
- Access controlMost privacy incidents involve someone seeing data they did not need. These checks keep access narrow, deliberate and reviewable.4 checks · 2 minOpens with credits
- Cross-border transfersMoving personal data between countries has its own rules, and "moving" includes remote access. These checks find transfers and make sure each has a basis.3 checks · 2 minOpens with credits
- Logging, telemetry and debuggingLogs are one of the most common places personal data leaks, because nobody thinks of them as a database. These checks keep them clean and useful.4 checks · 2 minOpens with credits
- Vendor and third-party sharingEvery vendor that receives personal data becomes part of your privacy posture. These checks control what you share and on what terms.4 checks · 2 minOpens with credits
- Breach readinessDeadlines for reporting a breach are short. These checks make sure engineers can detect, scope and escalate one quickly.3 checks · 2 minOpens with credits
About this checklist
Privacy problems in software rarely start with a decision to misuse data. They start with ordinary engineering shortcuts: a production table copied into an analytics sandbox with every column intact, an email address written to an application log, a vendor given a full export when it needed three fields, a "temporary" dataset that is still there three years later, or a support engineer in another country querying a database nobody thought of as a cross-border transfer. This data privacy checklist is for the people who make those choices every day: backend engineers, data engineers and analysts.
The checks draw on the text of the EU General Data Protection Regulation (GDPR), guidance from the UK Information Commissioner's Office (ICO), India's Digital Personal Data Protection Act 2023, the NIST Privacy Framework and the OWASP Logging Cheat Sheet. These sources share a small set of ideas: know what personal data you hold and where it goes, collect and keep only what the purpose needs, protect it in proportion to the harm its exposure could cause, and be ready to act quickly when something goes wrong.
This is general guidance, not legal advice. Which laws apply to you depends on where your organisation is, where the people whose data you hold are, and what you do with it. Pakistan, for example, had no comprehensive personal data protection law that we could confirm as enacted from an official source when this checklist was reviewed, though a bill has been under discussion. Confirm your actual legal duties with your organisation's privacy lead or legal counsel, and treat this list as the engineering work that supports whatever they decide.
Each check has a severity (must, should or nice) and a concrete way to verify it. The must checks are the ones that, when missed, most often turn into incidents.
Common questions
Is pseudonymized data still personal data?
Yes, in the GDPR's view. Pseudonymised data that can be linked back to a person using additional information, such as a key or mapping table, is still information about an identifiable person. The UK ICO says pseudonymisation reduces risk but does not take data outside the law. Only data that is truly anonymous falls outside it.
What personal data should never go in application logs?
The OWASP Logging Cheat Sheet lists session identifiers, access tokens, passwords, connection strings, encryption keys, payment card and bank data, and sensitive personal data among the things to remove, mask, hash or encrypt before logging. Log identifiers and actions instead of contents.
Does remote access from another country count as a data transfer?
It can. The UK ICO's guidance gives an example where letting an organisation in another country access personal data on your systems, without sending it, is still a restricted transfer. Check with your privacy lead which mechanism covers each country your data is stored in or accessed from.
How quickly must a personal data breach be reported?
Under the GDPR, a controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to people. Other laws set their own rules; India's DPDP Act requires notice to the Data Protection Board and each affected person. Your privacy lead or counsel decides; engineers should escalate immediately.
Does Pakistan have a data protection law?
When this checklist was reviewed in October 2026, we could not confirm from an official source that Pakistan had enacted a comprehensive personal data protection law, although a bill has been under discussion. Check the current position with counsel, and remember that laws such as the GDPR or India's DPDP Act may still apply if you serve people in those places.
Is this checklist legal advice?
No. It is general engineering guidance drawn from the GDPR, ICO guidance, India's DPDP Act and the NIST Privacy Framework. Which laws apply and what they require depends on your organisation and users, so confirm your legal duties with your privacy lead or legal counsel.
Sources (8)
Checked against these, last on 13 October 2026.
- Regulation (EU) 2016/679 (General Data Protection Regulation), EUR-Lexeur-lex.europa.eu/eli/reg/2016/679/oj
- Principle (c): Data minimisation, ICOico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/
- Pseudonymisation, ICOico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/
- International transfers: a guide, ICOico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/
- Personal data breaches: a guide, ICOico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/
- The Digital Personal Data Protection Act, 2023, Ministry of Electronics and IT, Indiawww.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf
- NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0, NISTdoi.org/10.6028/NIST.CSWP.01162020
- Logging Cheat Sheet, OWASPcheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html
Related on Sefism
Picked from the other libraries by shared topics.
Roadmaps
See allCheat sheets
See allBest practices
See all- Secrets Management Best PracticesKeep API keys, passwords and tokens out of git, logs and browser bundles: secret managers, scanning, rotation, OIDC in CI and leak response.
- Authentication Best PracticesBuild sign-in that holds up: password rules from NIST, Argon2id hashing, login throttling, MFA and passkeys, secure sessions and safe account recovery.
- Secure Coding Best PracticesWrite code that resists attack: untrusted input, validation, parameterized queries, output encoding, safe parsing, uploads, SSRF and errors that fail closed.
Checklists
See all- Web Application Security ChecklistA practical web application security checklist built on the OWASP Top 10:2025 and ASVS 5.0, with a severity and a way to verify every check.
- API Security ChecklistCheck your REST or GraphQL API against the OWASP API Security Top 10: authentication, object authorization, rate limits, input validation, SSRF, CORS and logging.
- Linux Server Hardening ChecklistHarden an Ubuntu, Debian or RHEL server step by step: accounts and sudo, SSH, updates, firewall and open ports, permissions, logging and CIS benchmark scans.
Project structures
See all- Firebase (Cloud Functions and security rules) project structureFor students building an app on Firebase who need a real backend: Cloud Functions (2nd gen) in TypeScript, Firestore and Storage security rules with tests, and the Local Emulator Suite. The tree starts from
firebase initand grows into feature folders of callables, triggers and scheduled jobs, then adds CI deploys, environments, contract tests and runbooks. - AI agent with an MCP server project structureFor developers who want to give AI assistants safe access to their own data or API. A TypeScript MCP server built on the official SDK, organised by feature (tasks, projects) with each feature owning its tools, resources and prompts, served over stdio for local hosts and Streamable HTTP with OAuth for remote ones, plus a small agent and the evals that prove a model can use it.
- Terraform project structureAn infrastructure repository for a small app on AWS: reusable modules, one folder per environment with its own remote state, pinned providers, tests and security scans, with plan on every pull request and apply from CI. For students who have finished the Terraform tutorials and want to know how a real team lays out the files. The same layout works unchanged with OpenTofu.
Career questions
See all- How do I get into AI security as a student or junior engineer?Build a normal security or software foundation first, then learn how LLM apps fail using the OWASP Top 10 for LLM Applications and MITRE ATLAS, and prove it by building, testing and hardening a small LLM app of your own. Most people reach AI security through AppSec, security engineering or ML engineering, not straight from university.
- Where do I start if I want a career in cybersecurity or IT operations?Start with the foundations both fields share: networking, Linux, and how systems fail. Then choose an entry role such as SOC analyst, IT support or junior cloud operations, and prove it with hands-on labs and one documented project rather than a stack of certificates.
- Can I use AI coding tools at my internship, and what should I never paste into them?Usually yes, but only the tools your company has approved, on the code and data they allow, and in the way they allow. Ask in your first week. Never paste secrets, customer data or code you are not permitted to share, and review everything the tool writes as if your name is on it, because it is.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com