GDPR и работа с данными

GDPR — обязательный framework для любой платформы с EU users. Fines до €20M или 4% годового оборота.

Ключевые принципы

Lawful basis: consent, contract, legitimate interest. Data minimization: только необходимое. Purpose limitation: не reuse без re-consent. Storage limitation: retention rules. Accuracy: обязательство поддерживать. Integrity и confidentiality. Accountability.

Data subject rights

Access: data export по запросу. Rectification: correction incorrect data. Erasure (right to be forgotten). Portability: machine-readable format. Objection: opt-out marketing/profiling. Automated decision-making rights. Обязательный процесс в 30 дней.

Technical implementation

Data inventory: где живёт какая PII. Consent management platform (OneTrust, Cookiebot). Anonymization/pseudonymization: hash user IDs. Encryption: PII always encrypted. Deletion mechanisms в data lake (soft delete + purge). Cross-region transfers: SCCs, adequacy decisions.

iGaming specifics

Conflict с AML retention (5+ years). Solution: legitimate interest для fraud data, but purpose-limited. RG data особо sensitive. Self-exclusion status protected. Marketing consent separate от service consent. Privacy-by-design для all new features.