---
name: data-security-compliance-automation
description: Automate data protection, privacy compliance, and security requirements across support operations including PII detection and redaction, GDPR/CCPA compliance, data retention, right to be forgotten, and audit logging. Use when implementing data protection in support, automating GDPR compliance, setting up PII redaction, managing data retention policies, handling data deletion requests, or maintaining security audit readiness. Triggers on phrases like "data security", "GDPR compliance", "PII redaction", "data retention", "right to be forgotten", "CCPA automation", "compliance audit", "data protection", "security automation".
---

# Data Security & Compliance Automation

Automate data protection, privacy compliance, and security controls across all support operations to maintain regulatory compliance and protect customer data at scale.

## Workflow

### 1. Automatic PII Detection and Redaction

1. **PII detection engine**:
   - **Scanned data types**: Ticket content, customer messages, agent responses, attachments, internal notes
   - **Detected patterns**:
     - Credit card numbers (all major card types, with Luhn validation)
     - Social security numbers (US, UK NI, Canada SIN)
     - Passwords and API keys
     - Email addresses (customer and third-party)
     - Phone numbers (international formats)
     - Physical addresses
     - Health information (PHI under HIPAA)
     - Driver's license numbers
     - Bank account numbers
     - IP addresses (optionally redacted)
   - **Detection accuracy**: 99.2% (tested against 10,000 annotated samples)
   - **Processing time**: <200ms per message

2. **Redaction workflow**:
   - Incoming message scanned before agent views ticket
   - PII replaced with placeholder: `[REDACTED: credit_card]`, `[REDACTED: SSN]`
   - Original data stored encrypted in secure vault (access-controlled)
   - Agent can request access to redacted data with business justification
   - Access request: Manager approval required, logged in audit trail
   - Redacted data auto-deleted after 30 days (configurable per policy)

3. **Attachment scanning**:
   - Images: OCR scan for text-based PII (credit card photos, ID documents)
   - Documents: PDF, Word, Excel scanned for PII patterns
   - Logs: Stack traces and error logs scanned for leaked credentials
   - Video: Frame-by-frame scan for visible PII
   - Flagged attachments: Quarantined, notification to security team

### 2. Privacy Regulation Compliance

1. **GDPR compliance automation**:
   ```
   GDPR COMPLIANCE WORKFLOW
   ========================
   
   Right to Access (Article 15):
     1. Customer submits data access request
     2. Auto-detect request via keyword scanning
     3. Verify customer identity (2-factor verification)
     4. Aggregate all customer data from support system:
        - All tickets and messages
        - Account information
        - Communication history
        - Agent notes
        - Survey responses
     5. Generate data export package (JSON, CSV, PDF)
     6. Deliver via secure channel (encrypted download link)
     7. Log fulfillment in compliance database
     8. Confirm delivery to customer
     Timeline: Automated within 48 hours (legal requirement: 30 days)
     
   Right to Erasure (Article 17 — Right to be Forgotten):
     1. Customer submits deletion request
     2. Verify identity (2-factor verification)
     3. Check for legal retention requirements:
        - Tax/legal: Keep for 7 years (cannot delete)
        - Active tickets: Cannot delete until resolved
        - Analytics: Anonymize instead of delete
     4. Execute deletion across all systems:
        - Support platform: Delete/anonymize records
        - CRM: Propagate deletion request
        - Data warehouse: Remove from analytical datasets
        - Backup systems: Flag for deletion in next cycle
     5. Generate deletion certificate for customer
     6. Log deletion in compliance audit trail
     Timeline: Automated within 48 hours (legal requirement: 30 days)
     
   Right to Portability (Article 20):
     1. Customer requests data export in machine-readable format
     2. Generate standardized export (JSON format)
     3. Include all customer-controlled data
     4. Provide download link valid for 7 days
     5. Auto-delete export after download or expiry
     
   Data Processing Agreement (DPA):
     1. Maintain DPA templates for all support subprocessors
     2. Auto-generate DPA for new customer requests
     3. Track subprocessor compliance (annual audits)
     4. Maintain record of processing activities (RoPA)
   ```

2. **CCPA compliance automation**:
   - Opt-out of sale: Automatic "Do Not Sell" flag on customer records
   - Consumer request: Identity verification → data disclosure or deletion
   - Service provider contracts: Auto-track CCPA-compliant data sharing
   - Financial incentive disclosure: Automated compliance notices

3. **HIPAA compliance (healthcare customers)**:
   - PHI detection: Automatic identification of health-related information
   - Access control: Role-based access restricted to authorized personnel
   - Audit logging: Every access to PHI recorded (who, when, why)
   - Breach notification: Auto-alert if PHI access exceeds threshold

### 3. Data Retention and Lifecycle Management

1. **Retention policies**:
   ```
   DATA RETENTION SCHEDULE
   =======================
   
   Ticket data (resolved):
     Active: Retain indefinitely (searchable)
     After 2 years: Archive (searchable, not in active queue)
     After 7 years: Anonymize (remove PII, keep for analytics)
     After 10 years: Delete (unless legal hold)
     
   Communication history:
     Customer messages: Same as ticket retention
     Agent internal notes: 3 years active, 4 years archive
     Voicemail recordings: 90 days active, 1 year archive
     
   Analytics data:
     Aggregated metrics: Indefinite (no PII)
     Individual metrics: 2 years, then aggregate
     
   Audit logs:
     Access logs: 7 years (regulatory requirement)
     Change logs: 7 years (regulatory requirement)
     Compliance logs: 10 years (regulatory requirement)
     
   Attachments:
     Customer uploads: Same as ticket retention
     Agent screenshots: 1 year active, 2 years archive
     Video recordings: 90 days (with consent)
   ```

2. **Automated lifecycle enforcement**:
   - Daily job: Process records nearing retention threshold
   - Batch operations: 1,000 records per batch to avoid system load
   - Pre-action notification: Alert data owner before bulk archive/delete
   - Legal hold override: Records on legal hold excluded from retention
   - Reporting: Monthly retention report (records archived, anonymized, deleted)

## Templates & Frameworks

### Compliance Dashboard

```
DATA SECURITY & COMPLIANCE DASHBOARD — January 2026
=====================================================

COMPLIANCE STATUS:
  Overall compliance score: 97/100 ✓ (target: >95)
  
  Framework compliance:
    GDPR: ✅ 98% compliant (2 minor findings)
    CCPA: ✅ 100% compliant
    HIPAA: ✅ 96% compliant (2 items in remediation)
    SOC 2: ✅ 97% compliant (1 finding in progress)
    ISO 27001: ✅ 99% compliant

PII DETECTION & REDACTION:
  Messages scanned today: 4,230
  PII detected today: 287 (6.8% of messages)
  Auto-redacted: 284 (99.0%)
  False positives: 3 (1.0%)
  Manual review required: 0
  
  PII types detected:
    Credit card numbers: 89
    Email addresses: 112
    Phone numbers: 56
    SSN: 12 ⚠ (high sensitivity — flagged)
    Addresses: 18
  
  Attachments scanned: 340
  Attachments with PII: 23 (6.8%)
  Quarantined attachments: 8 (contained high-sensitivity PII)

PRIVACY REQUESTS:
  Pending requests: 12 (target: <20)
  Processed this month: 47
  Average processing time: 18 hours (target: <48 hours) ✓
  
  Request types:
    Data access: 18 (38%)
    Data deletion: 21 (45%)
    Data portability: 8 (17%)
    
  SLA compliance: 47/47 (100% — all within 30-day legal requirement)
  Automated processing: 44/47 (93.6%)
  Manual intervention: 3/47 (6.4%)

DATA RETENTION:
  Records processed this month:
    Archived: 3,420 (reached 2-year threshold)
    Anonymized: 1,230 (reached 7-year threshold)
    Deleted: 420 (reached 10-year threshold)
    On legal hold: 12 (excluded from processing)
    
  Storage optimization:
    Space freed by retention: 2.4 TB
    Cost savings: $480/month (storage)
    
  Retention policy coverage: 100% of data categories

ACCESS CONTROL:
  Active support agents: 42
  Agents with PII access: 28 (66.7%)
  Agents with PHI access: 8 (19.0%) — healthcare team only
  Access review due: 14 agents (quarterly review scheduled)
  Unauthorized access attempts: 0 this month
  
  PII vault access requests:
    Submitted: 12
    Approved: 9 (75%)
    Denied: 3 (25%) — insufficient justification
    Average approval time: 2.3 hours

SECURITY INCIDENTS:
  Potential incidents detected: 3
  Confirmed incidents: 0
  False positives: 3 (100%)
  
  Detection types:
    Unusual data access pattern: 1 (agent accessed 100+ tickets in 1 hour — reviewed, legitimate)
    Bulk data export attempt: 1 (CSM exporting customer list — reviewed, authorized)
    Suspicious attachment upload: 1 (large file with many SSNs — reviewed, legitimate audit request)

AUDIT READINESS:
  Last audit: 2025-11-15 (SOC 2 Type II) — PASSED
  Next audit: 2026-05-15 (SOC 2 Type II) — 120 days
  Audit preparation score: 94/100 ✓
  
  Audit trail completeness:
    Access logs: 100% captured
    Change logs: 100% captured
    Deletion logs: 100% captured
    Privacy request logs: 100% captured
    
  Open findings:
    ⚠ HIPAA: PHI access audit log delayed by 2 hours (remediation: real-time sync — ETA Jan 20)
    ⚠ HIPAA: 3 agents need PHI access training renewal (training scheduled Jan 18)
    ✅ All GDPR findings resolved
    ✅ All SOC 2 findings resolved

COMPLIANCE RECOMMENDATIONS:
  1. Complete PHI access training for 3 agents (due Jan 18)
  2. Implement real-time PHI audit log sync (ETA Jan 20)
  3. Update DPA templates for new subprocessor (AWS Bedrock)
  4. Quarterly access review: 14 agents due for review (Jan 25)
```

### GDPR Request Processing Workflow

```
GDPR DATA DELETION REQUEST — Processing Template
==================================================

REQUEST ID: GDPR-DEL-2026-0047
REQUEST DATE: 2026-01-12 14:30 UTC
REQUEST TYPE: Right to Erasure (Article 17)

CUSTOMER IDENTIFICATION:
  Name: John Smith
  Email: john.smith@example.com
  Account ID: ACC-12345
  Verification method: 2-factor (email code + account verification)
  Verification completed: 2026-01-12 14:45 UTC ✅

DATA SCOPE:
  Support platform records:
    Tickets: 23 records identified
    Messages: 87 messages identified
    Account data: 1 record identified
    Survey responses: 3 records identified
    Agent notes: 12 records identified (internal, not customer-visible)
    
  Cross-system records:
    CRM: 1 account record
    Data warehouse: 23 analytical records
    Backup systems: 1 snapshot (scheduled for deletion next cycle)
    
LEGAL RETENTION CHECK:
  Tax/legal hold: No active holds ✅
  Active tickets: 2 open tickets ⚠
    TKT-98234: Open since Jan 5 — will resolve by Jan 20 (deletion deferred until resolved)
    TKT-98456: Open since Jan 10 — will resolve by Jan 18 (deletion deferred until resolved)
  Analytics retention: Anonymize instead of delete ✅
  
EXECUTION PLAN:
  Phase 1 (Immediate): Delete support messages, account data, survey responses
  Phase 2 (Jan 18-20): Delete ticket data after active tickets resolved
  Phase 3 (Ongoing): Anonymize analytical records in data warehouse
  Phase 4 (Feb 1): Delete from backup systems (next backup cycle)
  
COMPLETION:
  Phase 1: ✅ Completed Jan 12, 15:30 UTC
  Phase 2: ⏳ Scheduled Jan 18-20
  Phase 3: ✅ Completed Jan 12, 16:00 UTC
  Phase 4: ⏳ Scheduled Feb 1
  
  Deletion certificate: Generated and sent to customer Jan 12, 16:30 UTC
  Confirmation email: Sent to customer Jan 12, 16:30 UTC
  Audit log entry: Created ✅
  
  Total processing time: 2 hours (from verification to Phase 1 completion)
  Compliance: ✅ Within 48-hour target (legal requirement: 30 days)
```

## Integration Points

- **Support platforms** (Zendesk, Intercom, Freshdesk): Ticket data scanning, PII redaction, data deletion
- **CRM systems** (Salesforce, HubSpot): Customer data sync for privacy requests
- **Data warehouse** (Snowflake, BigQuery): Analytics data anonymization and deletion
- **Encryption services** (AWS KMS, HashiCorp Vault): Data encryption at rest and in transit
- **Identity management** (Okta, Auth0): Access control, role-based permissions
- **Compliance platforms** (OneTrust, Drata): Compliance monitoring, audit preparation, request management
- **Backup systems** (AWS Backup, Veeam): Retention and deletion in backup archives
- **Communication** (Slack, Teams): Security alerts, access request notifications
- **Legal case management**: Legal hold tracking, regulatory request management

## Edge Cases

- **PII in customer-provided code or screenshots**: Customer shares code snippet containing real API keys or error log with SSN:
  - Code scanning: PII detection in code blocks (not just text)
  - Screenshot OCR: Detect text-based PII in images
  - Agent guidance: "This message contains what appears to be an API key — redacted for security"
  - Notification: Alert customer that their API key was exposed and should be rotated
  - Education: Auto-insert tip: "Never share API keys or passwords in support messages"
- **Legal hold conflicts with deletion request**: Customer requests data deletion but account is under legal hold for ongoing litigation:
  - Legal hold detection: Check against legal case management system
  - Partial deletion: Delete non-essential data, retain legally required data
  - Customer communication: "We've processed your request while maintaining data required by legal obligations"
  - Timeline: Retained data auto-deleted when legal hold expires
  - Audit: Document split decision with legal team sign-off
- **Cross-border data transfer compliance**: EU customer data processed by support agent in US:
  - Data residency: Route EU customer tickets to EU-based agents only
  - SCC enforcement: Standard Contractual Clauses applied to all cross-border transfers
  - Regional data storage: EU customer data stored in EU data centers
  - Agent access control: US agents cannot access EU customer PII
  - Compliance monitoring: Regular audits of data transfer compliance
- **Bulk data export with hidden PII**: Customer requests data export (portability) but exported data contains other customers' info:
  - Data isolation: Export only includes requesting customer's own data
  - Validation: Automated scan of export package for third-party PII
  - Redaction: Any other customer's data automatically removed before delivery
  - Testing: Sample exports reviewed monthly for data leakage
  - Compliance: Export format standardized (JSON) with schema validation
- **Agent accidentally accesses PII of unrelated customer**: Agent searches for wrong customer and views sensitive ticket history:
  - Access logging: Every record access logged (agent, timestamp, record, reason)
  - Alert: Unusual access pattern detected (viewing customers outside assignment)
  - Auto-restrict: Temporary access review triggered
  - Manager notification: Team lead alerted of potential policy violation
  - Training: Mandatory retraining if accidental access occurs
  - Zero tolerance: Deliberate unauthorized access → immediate revocation + HR escalation

## Output

### Quarterly Compliance Report

```
QUARTERLY COMPLIANCE REPORT — Q4 2025
========================================

OVERALL COMPLIANCE SCORE: 97/100 ✓ (Q3: 95/100 — improvement: +2 points)

PII PROTECTION:
  Messages scanned: 126,900 (quarter total)
  PII detected and redacted: 8,712 (6.9%)
  False positive rate: 1.0% (target: <2%) ✓
  Attachments scanned: 10,230
  High-sensitivity PII quarantined: 234
  
  IMPROVEMENT: False positive rate reduced from 1.8% to 1.0% (AI model updated Q3)

PRIVACY REQUESTS:
  Total requests processed: 142
  Data access: 54 (38%)
  Data deletion: 67 (47%)
  Data portability: 21 (15%)
  
  Average processing time: 21 hours (target: <48 hours) ✓
  Automated processing rate: 94.4% (target: >90%) ✓
  SLA compliance: 100% (all within 30-day legal requirement)
  
  TREND: Privacy requests ↑ 23% from Q3 (industry-wide increase)

DATA RETENTION:
  Records archived: 10,260
  Records anonymized: 3,690
  Records deleted: 1,260
  Storage cost savings: $1,440/quarter
  
  COMPLIANCE: 100% of data categories covered by retention policy

SECURITY INCIDENTS:
  Potential incidents detected: 9
  Confirmed incidents: 0
  False positives: 9 (100%)
  
  Zero security breaches or data leaks this quarter ✓

AUDIT RESULTS:
  SOC 2 Type II audit (Nov 2025): PASSED
    Findings: 3 minor (all resolved within 30 days)
    Overall assessment: "Controls operating effectively"
    
  Next audit: SOC 2 Type II (May 2026)
  Current preparation score: 94/100 ✓

RECOMMENDATIONS FOR Q1 2026:
  1. Complete PHI access training for 3 agents (HIPAA finding)
  2. Implement real-time audit log sync (HIPAA finding)
  3. Update subprocessor DPA for new AI services
  4. Conduct annual access review for all 42 agents
  5. Test disaster recovery for compliance data (annual requirement)
```