Picking up where the overview left off

The senior course "Compliance: the regulatory landscape" told you GDPR is Regulation (EU) 2016/679, applicable since 25 May 2018. It told you the trigger is the data subject's location and the market you offer into, and not your company's address. It told you the distinction between controller and processor exists, and that fines scale in two tiers with the seriousness of the violation. All of that stays true, and none of it is repeated here.

What the overview skipped on purpose is everything a Rails engineer does once GDPR applies. Which of six lawful bases justifies a given database write? What happens when a user emails asking to be forgotten? Why is dependent: :destroy no answer to that email? That's this course.

Why "we have a privacy policy" was never the hard part

A privacy policy is a document. GDPR compliance is a set of running systems. It's a basis recorded before the row is written, and a workflow that turns a support ticket into a verified identity and a bounded response. It's a deletion path that reaches backups, logs and third-party vendors, beyond the users table. Writing the policy takes an afternoon; building the systems it promises is the rest of this course.

The six lessons ahead

Each lesson takes one operational piece and follows it into a Rails-shaped decision:

• Lesson 2: the six lawful bases, why consent is the one everyone reaches for and the one most often wrong, and the rule that the basis is chosen before collection and can't be swapped later to justify a new use.
• Lesson 3: the data subject rights as workflows: what each one requires an app to do, the one-month clock, and why verifying identity is itself a risk.
• Lesson 4: erasure at scale: why deleting a User row is the easy 5% of the problem, and what soft delete, hard delete and crypto-shredding each buy you.
• Lesson 5: data minimisation, purpose limitation and retention as decisions made in a migration, beyond a policy PDF.
• Lesson 6: processors, subprocessor chains, and what "this data leaves the EU" means for an architecture that includes a US SaaS vendor.
• Lesson 7: the 72-hour breach clock, what has to exist before it starts, and where the next deep dive picks up.

One ground rule for the whole course

Nothing here is legal advice, and nothing here should be the last word on a real company's obligations. The goal is narrower: know which decisions are legal calls that need a lawyer or a data protection officer, and be the engineer who can build what they decide. A senior engineer who can turn "we need a lawful basis for this" into a migration and a service object is worth more in this conversation than one who can recite article numbers.

With that framing set, lesson 2 starts where most Rails teams first get GDPR wrong. It's at the point of collection, before a single row exists, and well before deletion.