GDPR Compliant ERP Systems & European Data Sovereignty

Global Privacy Systems: GDPR Compliance & Data Sovereignty

Executive Summary

This is how ERPStack implements GDPR compliant ERP platforms. Article 83(5) sets the upper tier of administrative fines at 20 million euros or 4% of total worldwide annual turnover, whichever is higher. That figure makes privacy an architecture problem rather than a policy problem: where records live, who can reach them, and how fast they can be produced or destroyed are decisions made in the PostgreSQL schema, not in a document.

Privacy by Design, in the Schema

Data residency and routing. Regional PostgreSQL clusters — AWS eu-central-1 in Frankfurt alongside a US region — hold records in their home jurisdiction. Routing derives from the controller's tenancy, not from a request header a client can set. Cross-region reads are denied at the database role level, so an application bug cannot quietly relocate personal data. Multi-tenant isolation is enforced by row-level policies rather than by an WHERE clause someone might forget.

Data minimisation. Schemas capture only the fields a process needs. Every optional column is an ongoing liability in a DSAR, a breach notification, and a retention review, so the default answer to a speculative field is no.

Consent management. Consent is a first-class table with history: what was agreed, when, under which version of the notice, through which interface. Withdrawal is recorded the same way, which is what makes the record defensible months later.

Pseudonymisation. Identifiers are decoupled from transactional tables. Reporting queries in the ERP join on opaque UUIDs, so an analyst produces revenue by segment without ever seeing a name.

Data Subject Rights, Automated

Articles 15 to 20 cover access, rectification, erasure, restriction, notification, and portability. Drizzle ORM turns each into an administrative action rather than a project.

// Article 17 erasure. The deletion event is logged, but the log row
// carries no personal data — only request id, timestamp, tables touched.
import { eq } from 'drizzle-orm';
import { db } from '@/libs/DB';
import { leadSchema } from '@/models/Schema';

export async function processGdprErasure(email: string, requestId: string) {
  return db.transaction(async (tx) => {
    await tx.delete(leadSchema).where(eq(leadSchema.email, email));
    await tx.insert(erasureLog).values({ requestId, tables: ['leads'] });
    return { success: true, message: 'Records removed from active tables.' };
  });
}

A DSAR export assembles every row keyed to the data subject — profile, orders, tickets, consent history, audit entries — into machine-readable JSON plus a human-readable PDF. Because the query runs against your own PostgreSQL schema rather than a vendor export queue, it completes in seconds instead of days.

Breach Notification Infrastructure

Article 33 requires notification to the supervisory authority without undue delay and, where feasible, not later than 72 hours after the controller becomes aware of a personal data breach. 72 hours is not enough time to collect logs from 4 systems by hand, so detection lives in the data layer. Alerts fire when an account reads or exports an abnormal volume in one session. Rate limiters at the API edge block bulk extraction and log the attempt with actor and origin. AWS snapshots are encrypted with keys held separately, so a lost storage volume is not a reportable disclosure.

Operational Outcomes

Access, portability, and erasure become SQL queries with an audit trail attached. Several regional PostgreSQL databases run under one administrative interface and one RBAC model. Residency, retention, and consent state are visible in the schema — which is exactly where a supervisory authority asks to look.

Stack and Boundaries

The GDPR compliant ERP runs on Next.js and TypeScript with PostgreSQL behind Drizzle ORM, deployed by Terraform into your own AWS account. RBAC is enforced in the Next.js API layer, Redis caches only non-personal data, and Zod validates 100% of API boundaries. Semgrep SAST, Vitest, and Playwright run in GitHub Actions on every commit; Sentry carries error telemetry with personal fields scrubbed. ERPStack operates 0 of it: after handover no ERPStack account reaches your PostgreSQL cluster, your AWS keys, or your GDPR records — which is the cleanest answer a processor can give a controller.