A European client's personal data will flow through your system. What do you address before building?
Why A is the answer
The GDPR lawful basis, data flows and where processing happens
GDPR questions shape the architecture. They are far cheaper to settle before the design than after it.
In detail
- GDPR questions shape the architecture.
- They are far cheaper to settle before design than after it.
- Involve your data protection lead early.
Use case
An illustrative scenario, not a real incident.
A retailer plans to process European customer data. The architect confirms the lawful basis, maps the data flows and settles where processing happens before design starts.
See it in different ways
flowchart LR A["Classify the data"] --> B["Apply regulation"] B --> C["Choose deployment and vendors"] C --> D["Minimize and redact"] D --> E["Log and audit"]
mindmap
root((Compliance))
Health data
Contract terms
EU personal data
Lawful basis
Where it is processed
US federal
FedRAMP
All
Data minimization
Audit trailmindmap
root(("GDPR"))
n1["Lawful basis"]
n2["Why you may process it"]
n3["Data flows"]
n4["Where data moves"]
n5["Location"]
n6["Where processing happens"]Key point: GDPR questions shape the architecture.
Why the other options are wrong
- B. How to word a banner explaining that the feature uses AI
- A banner does not settle whether the processing is lawful.
- C. Which chart library will display the compliance dashboard
- A chart library has no bearing on compliance.
- D. Whether the assistant should reply in more than one language
- Language support is a product choice, not a data question.