GDPR Compliance for Java Applications

// Annotate fields so the inventory is derivable from code rather than a
// spreadsheet that drifts out of date.
@Target(ElementType.FIELD)
@Retention(RetentionPolicy.RUNTIME)
public @interface PersonalData {
    Category category();          // IDENTITY, CONTACT, FINANCIAL, BEHAVIOURAL
    boolean special() default false;   // special-category data under Article 9
    String retention();           // "7 years", "until account closure"
}
 
@Entity
public class Customer {
    @PersonalData(category = Category.IDENTITY, retention = "until account closure")
    private String fullName;
 
    @PersonalData(category = Category.CONTACT, retention = "until account closure")
    private String email;
 
    @PersonalData(category = Category.FINANCIAL, retention = "7 years (tax law)")
    private String taxId;
}

@Service
public class DataExportService {
 
    private final List<PersonalDataProvider> providers;   // one per service or domain
 
    public ExportPackage export(String subjectId) {
        // Identity verification happens before this — releasing someone's data
        // to an impersonator is itself a breach.
        var sections = providers.stream()
                .map(provider -> provider.exportFor(subjectId))
                .filter(section -> !section.isEmpty())
                .toList();
 
        auditLog.record("gdpr.export", subjectId);
        // Machine-readable and structured, per the portability right.
        return new ExportPackage(subjectId, Instant.now(), sections);
    }
}
 
// Each service implements this, so a new service that holds personal data
// cannot be forgotten — it either implements the interface or it does not
// hold personal data.
public interface PersonalDataProvider {
    DataSection exportFor(String subjectId);
}

@Service
public class ErasureService {
 
    @Transactional
    public ErasureResult erase(String subjectId) {
        var result = new ErasureResult();
 
        // Data with no retention obligation: hard delete.
        marketingRepository.deleteBySubject(subjectId);
        behaviouralRepository.deleteBySubject(subjectId);
        result.deleted("marketing", "behavioural");
 
        // Data legally required to be retained: anonymise so it no longer
        // relates to an identifiable person, but the record survives for
        // the financial and legal purposes that mandate keeping it.
        orderRepository.findBySubject(subjectId).forEach(order -> {
            order.anonymise();   // name -> "REDACTED", email -> null, address -> region only
            result.anonymised("orders");
        });
 
        // Some data enters a hold rather than being erased: an active dispute,
        // a legal obligation to preserve. Record why.
        if (disputeService.hasActiveDispute(subjectId)) {
            result.retained("orders-in-dispute", "active legal dispute");
        }
 
        auditLog.record("gdpr.erasure", subjectId, result.summary());
        return result;
    }
}

@Entity
public class ConsentRecord {
    @Id private UUID id;
    private String subjectId;
 
    @Enumerated(EnumType.STRING)
    private ConsentPurpose purpose;   // ANALYTICS, MARKETING, PERSONALISATION
 
    private boolean granted;
    // The exact wording the subject agreed to, so you can prove WHAT was
    // consented to, not just that something was.
    private String policyVersion;
    private Instant timestamp;
    private String ipAddress;
    private String mechanism;         // "cookie banner", "signup checkbox"
}

@Component
public class RetentionEnforcementJob {
 
    @Scheduled(cron = "0 0 2 * * *")
    @SchedulerLock(name = "retentionEnforcement", lockAtMostFor = "PT1H")
    public void enforce() {
        // "We keep data as long as necessary" is not a policy unless a job
        // enforces it. Keeping data past its stated retention is a violation
        // even if nobody ever looks at it.
        retentionPolicies.forEach(policy -> {
            var expired = policy.findExpired(Instant.now());
            expired.forEach(record -> {
                archiveIfRequired(record);   // legal hold check first
                policy.erase(record);
            });
            log.info("retention: erased {} {} records", expired.size(), policy.dataType());
        });
    }
}

@Service
public class BreachResponseService {
 
    /** Who was affected — the question you must answer within 72 hours. */
    public AffectedSubjects assess(BreachScope scope) {
        return switch (scope.type()) {
            case DATABASE_EXPOSURE -> new AffectedSubjects(
                    subjectRepository.findInTables(scope.affectedTables()),
                    scope.dataCategories());
            case CREDENTIAL_LEAK -> new AffectedSubjects(
                    subjectRepository.findByCredentialSource(scope.source()),
                    Set.of(Category.IDENTITY));
            case LOG_EXPOSURE -> logAnalyser.subjectsInExposedLogs(scope.timeRange());
        };
    }
}