GDPR Compliance

The General Data Protection Regulation (GDPR, EU Regulation 2016/679) has been fully implemented in the EU since May 25, 2018, and is one of the strictest and most influential personal data protection laws globally. It applies to operators providing energy services in the EU, as well as all processors offering goods or services to data subjects in the EU or monitoring their behavior (regardless of where the business is registered). Violators can be fined up to 4% of global annual turnover or €20 million (whichever is higher).

In power and energy scenarios, user electricity consumption behavior data, smart meter readings, customer account information, repair records, payment records, load forecasting inputs, etc., all constitute personal data subject to GDPR. EnerOS provides Data Subject Rights (DSR) APIs, Records of Processing Activities (ROPA), and data localization capabilities to help operators fulfill their compliance obligations.

Data Subject Rights Mapping

Articles 12-22 of GDPR stipulate eight core rights for data subjects. EnerOS provides corresponding API endpoints for each right:

Right Response SLA Configuration

[dsr]
enabled = true
default_response_days = 30
extension_max_days = 60                  # Complex requests can be extended
notify_subject_on_extension = true
auto_escalate_days = 25                  # Auto-escalate near deadline

[dsr.endpoints]
notice = "/dsr/notice"
access = "/dsr/access"
correct = "/dsr/correct"
erase = "/dsr/erase"
restrict = "/dsr/restrict"
export = "/dsr/export"
object = "/dsr/object"
no_automated = "/dsr/no-automated"

Data Processing Principles

Article 5 of GDPR stipulates six core data processing principles. EnerOS implements each one in engineering:

Lawful Basis

Article 6 of GDPR stipulates six lawful bases. EnerOS mandates that each data flow declare its basis:

[data_flow.legality_basis]
allowed_values = [
    "consent",              # Consent (Art. 6(1)(a))
    "contract",             # Contract performance (Art. 6(1)(b))
    "legal-obligation",     # Legal obligation (Art. 6(1)(c))
    "vital-interest",       # Vital interests (Art. 6(1)(d))
    "public-task",          # Public task (Art. 6(1)(e))
    "legitimate-interest"   # Legitimate interests (Art. 6(1)(f))
]

use eneros_privacy::dataflow::DataFlow;

let flow = DataFlow::builder()
    .name("smart-meter-collection")
    .purpose("load-forecasting")
    .legality_basis("contract")
    .retention_days(365 * 7)
    .pii_fields(["customer_id", "meter_id", "consumption_kwh"])
    .build()?;

flow.register().await?;

EnerOS Data Protection Implementation

1. Data Classification and Tagging

All data fields are tagged with PII markers in the schema for differentiated protection:

[data.classification]
enabled = true

[[data.fields]]
name = "customer_id"
pii = true
category = "direct-identifier"
encryption = "AES-256-GCM"

[[data.fields]]
name = "meter_id"
pii = true
category = "pseudo-identifier"
encryption = "AES-256-GCM"
pseudonymization = true

[[data.fields]]
name = "consumption_kwh"
pii = false
category = "operational"
retention_days = 2555

2. Field-level Encryption and Column-level Access Control

use eneros_tenant::encryption::FieldCipher;

let cipher = FieldCipher::new("AES-256-GCM")
    .key_id("kms-key-customer-pii")
    .aad(b"tenant=eu-west-1");

// Auto-encrypt on write
let encrypted = cipher.encrypt(customer_id.as_bytes())?;
db.insert("customers")
    .set("customer_id", encrypted)
    .set("meter_id", cipher.encrypt(meter_id)?)
    .await?;

// Decrypt based on role on read
let row = db.select("customers").where_eq("id", 42).fetch().await?;
let customer_id = if user.has_permission("pii:read") {
    cipher.decrypt(row.get("customer_id"))?
} else {
    "REDACTED".to_string()
};

3. Records of Processing Activities (ROPA)

Article 30 of GDPR requires maintaining records of processing activities. EnerOS auto-generates ROPA reports:

# Export ROPA
eneros-cli audit ropa --output ropa-2026Q2.json

# Export CSV format
eneros-cli audit ropa --format csv --output ropa-2026Q2.csv

# Export PDF (for audit delivery)
eneros-cli audit ropa --format pdf --output ropa-2026Q2.pdf

ROPA reports contain the following fields:

Data Flow Diagram

EnerOS visualizes the full-chain flow of personal data through data flow diagram tools to help identify compliance risks:

┌─────────────────┐     ┌──────────────────┐     ┌─────────────────┐
│  Smart Meter     │────▶│  EnerOS Gateway  │────▶│  Time-series     │
│  Terminal        │     │  mTLS + Encryption│     │  Storage Engine  │
│  (PII: meter_id) │     │                  │     │  AES-256-GCM     │
└─────────────────┘     └──────────────────┘     └─────────────────┘
                                                         │
                                                         ▼
┌─────────────────┐     ┌──────────────────┐     ┌─────────────────┐
│  DSR API         │◀────│  Query/Export/    │◀────│  Load Forecasting│
│  Endpoint        │     │  Delete           │     │  Agent           │
│  /dsr/*          │     │  RBAC + ABAC      │     │  Masked access   │
└─────────────────┘     └──────────────────┘     └─────────────────┘
                                                         │
                                                         ▼
                                                ┌─────────────────┐
                                                │  WORM Audit Chain│
                                                │  HMAC + 7-yr ret.│
                                                └─────────────────┘

Data Flow Registration

[[data_flow]]
name = "smart-meter-collection"
source = "meter-device"
destination = "eneros-timeseries"
data_categories = ["meter_id", "consumption_kwh"]
purpose = "load-forecasting"
legality_basis = "contract"
retention_days = 2555
cross_border = false

[[data_flow]]
name = "billing-export"
source = "eneros-timeseries"
destination = "billing-system"
data_categories = ["customer_id", "amount_due"]
purpose = "billing"
legality_basis = "contract"
retention_days = 3650
cross_border = false

Configuration Example

GDPR Configuration in eneros.toml

[compliance]
standard = "gdpr"
version = "2016/679"
enforce = true
dpo_email = "dpo@eneros.io"

[gdpr]
enabled = true
data_residency = "eu"                    # Data residency region
cross_border_policy = "adequacy-only"    # Only allow adequacy-decision countries
breach_notification_hours = 72           # Data breach notification SLA
default_retention_years = 7

# Data subject rights
[gdpr.dsr]
response_days = 30
extension_days = 60
auto_escalate_days = 25

# Records of processing activities
[gdpr.ropa]
auto_generate = true
schedule_cron = "0 0 1 * *"              # Auto-generate on 1st of each month
retain_years = 7

# Field encryption
[gdpr.encryption]
algorithm = "AES-256-GCM"
key_management = "kms"
rotate_days = 365
aad_fields = ["tenant_id", "region"]

# Cross-border transfer
[gdpr.cross_border]
default_policy = "deny"
adequacy_countries = ["CH", "GB", "JP", "CA"]
explicit_consent_required = true

# Data retention
[gdpr.retention]
default_days = 2555
auto_delete = true
notify_before_days = 30

DPIA Assessment

A Data Protection Impact Assessment (DPIA) is a mandatory process required by Article 35 of GDPR for high-risk processing activities. EnerOS provides DPIA template auto-generation and assessment tools.

DPIA Trigger Conditions

A DPIA must be conducted in the following scenarios:

• Large-scale systematic monitoring (e.g., grid-wide smart meter data collection)
• Large-scale data processing in public areas
• Automated decision-making and profiling
• Processing of sensitive data (health, biometrics, etc.)
• Cross-border data transfers

DPIA Template Generation

# Generate DPIA assessment template
eneros-cli dpia init --project "smart-meter-rollout-2026" \
  --output dpia-smart-meter-2026.md

# Auto-fill some fields
eneros-cli dpia autofill --input dpia-smart-meter-2026.md \
  --data-flow smart-meter-collection

# Submit for review
eneros-cli dpia submit --input dpia-smart-meter-2026.md \
  --reviewer dpo@eneros.io

DPIA Assessment Elements

DPIA Risk Assessment Matrix

Invocation Example

// Handle right of access request
let report = dsr.access("subject-42").await?;
// report contains all relevant time-series points, audit records, and third-party sharing list

// Handle right to erasure request
let result = dsr.erase("subject-42")
    .reason("user-request")
    .approver("dpo@eneros.io")
    .cascade(true)             // Cascade delete related data
    .await?;

eneros-cli dsr erase subject-42 --reason "user-request" \
  --approver dpo@eneros.io

# Data portability export
eneros-cli dsr export subject-42 --format json \
  --output subject-42-export.json

# View records of processing activities
eneros-cli audit ropa --tenant eu-west-1

# Data breach notification simulation
eneros-cli gdpr breach-notify --subject "smart-meter-leak-2026" \
  --affected-subjects 1000 \
  --authority "dpa-ireland" \
  --within-hours 72

Deletion operations fall into the WORM audit chain, proving that the deletion obligation has been fulfilled.

Compliance Checklist

Confirm each item before deployment:

• All personal data fields tagged with pii=true
• Default field-level encryption (AES-256-GCM) + column-level access control
• DSR requests responded to within 30 days, with auto-escalation on timeout
• Records of processing activities (ROPA) exportable via eneros-cli audit ropa
• Cross-border transfers only allowed to adequacy-decision countries
• Data retention auto-deletes after 7 years by default (unless legally longer)
• Data Protection Officer (DPO) appointed with public contact information
• Data breaches reported to supervisory authority within 72 hours
• DPIA assessment conducted and archived for high-risk processing activities
• Data subject consent is withdrawable and easy to operate
• Automated decision-making provides human review channel
• Data processors sign DPA agreements
• Privacy policy clearly lists all processing activities
• Data protection liaison appointed (EU representative, if applicable)
• Data protection training conducted annually and archived

Related Documentation

• PIPL Data Localization
• CCPA Right to Know and opt-out
• Internationalization and Compliance
• Multi-region and Disaster Recovery