Compliance & Data Governance

PII Compliance · GDPR · Data Classification · Audit Trail · Retention Policies

PII & Data Protection

GDPR · Data Minimisation · Pseudonymisation · Right to Erasure

Data Classification4-tier: Public · Internal · Confidential · Restricted (PII/PCI). Classification applied at field level — not document level. Drives encryption, access control and retention rules.

PII HandlingPII fields (name, address, MSISDN, IMEI, NIN) encrypted at field level with service-specific encryption keys. PII never logged. PII masked in non-production environments. PII map maintained per service.

Data MinimisationServices collect only the PII fields they are authorised to process. No data hoarding — PII not replicated to services that do not require it. Enforced via API contract reviews.

Right to ErasureErasure request triggers a propagated deletion event across all services holding subscriber PII. Services must confirm deletion within SLA (72 h). Audit trail of deletion is retained (without the PII).

PseudonymisationAnalytics and reporting pipelines use pseudonymised subscriber IDs — not real MSISDN or account IDs. Mapping table held in restricted access vault accessible only to authorised data teams.

Audit TrailImmutable audit log of every read and write on PII fields. Log entries: who accessed, what data, from which service, when. Audit logs stored in tamper-evident write-once storage. Retained 7 years.

GDPR Field Encryption Data Minimisation Right to Erasure Pseudonymisation Immutable Audit Log

Data Retention & Lifecycle

Retention Policies · Automated Purge · Archival · Legal Hold

Data Type	Hot Retention	Archive	Purge
Subscriber PII	Active + 6 months post-churn	6–13 months cold	13 months (unless legal hold)
Call Records (CDR)	6 months	6–24 months	24 months (regulatory minimum)
Invoice & Billing	2 years	2–7 years cold	7 years (financial regulation)
Order History	2 years	2–5 years	5 years
Audit Logs	90 days	90 days – 7 years	7 years (never auto-purge)
Application Logs	30 days	30–90 days	90 days

Non-Functional Requirements — Summary Reference

NFR Category	Requirement	Target / Standard	Status
Availability	Platform availability SLO	99.99% (≈ minutes per year)	Mandatory
Latency	API P99 latency (tier-1 services)	< Sub-second P99	Mandatory
Throughput	CDR processing rate	Very High — stream processing sustained	Mandatory
RTO	Revenue-critical service recovery	<Minutes (Tier 0 — near-zero)	Mandatory
RPO	Maximum data loss window	Near-zero (Tier 0 — synchronous replication)	Mandatory
Security	Encryption in transit	TLS 1.3+ on external traffic, mTLS on all inter-service communication	Mandatory
Security	Encryption at rest	AES-256-GCM all data stores	Mandatory
Identity	Authentication protocol	OAuth 2.0 / OIDC + Workload Identity Standard workload identity	Mandatory
PII Compliance	GDPR — Right to Erasure SLA	Confirmed deletion within the regulatory SLA window	Mandatory
Resilience	Circuit breaker on all external calls	Error rate >50% in 10 s window triggers open	Mandatory
Idempotency	All financial mutation endpoints	Idempotency key + 24 h dedup store	Mandatory
Scalability	HPA on all stateless services	CPU target 60%, scale within a short cool-down window	Mandatory
Anti-Affinity	Pod distribution	Required: no two replicas on same node; Preferred: spread across AZs	Mandatory
Technical Debt	Sprint debt remediation allocation	Minimum 20% per sprint	Recommended
Observability	Distributed tracing coverage	100% of requests carry traceId; 10% sampled	Mandatory
CI/CD Security	SAST + SCA in every pipeline	Critical/High CVEs block merge	Mandatory

Compliance & Data Governance

Telecom

Apps

Company