GDPRi

GDPRi is a term used in privacy engineering to describe a design approach that seeks to embed General Data Protection Regulation requirements into the architecture and operation of information systems throughout their life cycle. It is not an official standard or certification, but a shorthand used by practitioners and vendors to discuss how systems can be engineered to support GDPR obligations such as data minimization, purpose limitation, data subject rights, security, and accountability.

Conceptually, GDPRi emphasizes data mapping, governance, and automation of rights requests. Key components include: data inventory and mapping, purpose limitation tracking, consent management, data minimization and retention controls, access and rectification workflows, erasure (right to be forgotten) processes, data portability support, audit logging, and verifiable privacy impact assessments. Interfaces and APIs are often proposed to enable regulated data flows between data controllers, processors, and data subjects, with built-in traceability and tamper-evident records.

Adoption and status: GDPRi is discussed in privacy engineering circles, but it is not an adopted standard by European authorities. It appears mainly in white papers, vendor documentation, and pilot projects as a framework to structure compliant system design rather than a legal requirement. Critiques include potential implementation complexity, over-reliance on automated rights processing, and the need for context-specific interpretation of GDPR concepts.

See also: General Data Protection Regulation, privacy by design, data governance, data subject rights.