Step 2: Create a Transformation Record

Before transforming data, attach the example's declared processing purpose and list of personal-data fields. This metadata can support an audit trail, but a value written by the pipeline does not prove that the stated legal basis applies or that processing was lawful.

The Goal

Add a _gdpr_compliance object containing:

• Legal basis for processing (GDPR Article 6)
• List of original PII fields
• Anonymization flag
• Transfer type description
• Relevant GDPR article citation

Why This Matters

The record below documents the fields and operations selected by this example. It is technical metadata, not a legal determination.

Audit Context: This record captures what the pipeline was configured to assert. Reviewers still need evidence for the declared purpose, lawful basis, notices, controls, and actual operation.

Incident Response: If challenged, you can show exactly what was anonymized.

Implementation

See the transformation-record processor in the canonical reference. It preserves the origin metadata from the preceding stage; inspect both in the Explorer.

Understanding the Code

Field	Purpose
legal_basis	GDPR Article 6 lawful basis (consent, contract, legitimate interest, etc.)
original_pii_fields	Explicit list of personal data being processed
anonymization_applied	Flag indicating data will be anonymized
transfer_type	Description of the data transfer
gdpr_article	Relevant GDPR provision

Legal Basis Options

Common lawful bases under GDPR Article 6:

Basis	Use When
consent	User explicitly agreed
contract	Necessary for service delivery
legal_obligation	Required by law
vital_interests	Life/death situations
public_task	Public authority functions
legitimate_interest	Business need, balanced against user rights

For analytics, legitimate_interest is common but requires a balancing test.

Expected Output

{
  "transaction_id": "TXN-EU-2024-00001",
  "customer_id": "CUST-DE-12345",
  ...,
  "_data_origin": {...},
  "_gdpr_compliance": {
    "legal_basis": "legitimate_interest_analytics",
    "original_pii_fields": [
      "customer_id",
      "customer_name",
      "customer_email",
      "customer_dob",
      "customer_address",
      "iban",
      "ip_address"
    ],
    "anonymization_applied": true,
    "transfer_type": "cross_border_eu_to_global",
    "gdpr_article": "Article 44 - General principle for transfers"
  }
}

Adaptation checks

Dynamic Legal Basis

Different processing purposes may have different bases:

Partial snippet

root._gdpr_compliance.legal_basis = match this.processing_purpose {
"fraud_detection" => "legitimate_interest_security",
"marketing" => "consent",
"service_delivery" => "contract",
_ => "legitimate_interest_analytics"
}

Data Subject Rights Reference

Include rights information for audit completeness:

Partial snippet

root._gdpr_compliance.data_subject_rights = {
  "access": "Article 15",
  "rectification": "Article 16",
  "erasure": "Article 17",
  "portability": "Article 20"
}

Retention Policy

Document how long data is kept:

Partial snippet

root._gdpr_compliance.retention = {
  "anonymized_data": "indefinite",
  "eu_archive": "7_years",
  "audit_logs": "10_years"
}

---

Next Step

📖 Step 3: Delete High-Risk Fields →