Privacy Lab 01 — PII Data-Flow Analyzer

WARMUP: Chapters 2–6 (taxonomy, data flows, lawful basis/retention, transfer).

Threat model

The "attacker" here is the organization's own data practices: collecting personal data with no purpose, no lawful basis, keeping it past need, writing it to logs, or shipping it to a non-adequate region without a safeguard. Each is a privacy violation independent of any breach. This engine turns a data-flow inventory into severity-ranked findings and a compliance gate.

What you build (`lab.py`)

analyze_flow(flow) — for personal-category flows: over-collection (no purpose), no-lawful-basis, over-retention (per-category cap), pii-in-logs (critical for sensitive/PHI), unsafe-transfer.
analyze(flows) — all findings, severity-sorted.
is_compliant(flows) — no high-or-above.

Attack cases the tests cover

A clean PII flow (purpose, lawful basis, short retention, EU, not logged) is compliant.
Each violation is flagged at the right severity; sensitive/PHI in logs = critical; over-retention honors tighter per-category caps; a cross-border transfer is unsafe without a safeguard but fine with SCCs or to an adequate region; non-personal data is never flagged; severity-sorted.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q
pytest -q

Hardening / extensions

Add purpose-creep detection (a field used by more purposes than it was collected for).
Generate a DSAR/erasure reachability report (every store holding a given subject's data).
Model consent state and flag processing without active consent where consent is the basis.

Interview / resume

"Built a PII data-flow analyzer that flags over-collection, missing lawful basis, over-retention, PII in logs, and unsafe cross-border transfers from a data inventory — turning GDPR principles into a tested compliance gate."

Limitations: rule-based over a data-flow inventory; retention caps and adequate-region list are configurable inputs, not legal advice.

Security Engineer