DPO checklist

Before running Brume on production data:

• Secrets are stored in your secret manager (Vault, SOPS, AWS Secrets Manager, GitHub Encrypted Secrets…), not in plaintext on disk or in git.
• Source is accessed with a read-only account.
• brume.yml is in version control and has gone through code review.
• brume plan has been run and its list of uncovered PII columns has been reviewed.
• brume dry-run completes with zero errors.
• brume audit --anonymity has been run on the resulting dataset — see k-Anonymity audit.
• Recipients of the pseudonymized dataset are limited to the strict minimum (dev, QA, demo).
• The dataset is not labelled “anonymous” in any internal documentation or external communication.
• A retention period is set on the pseudonymized copy.
• Logs from the run are archived (use --json to ingest them in your SIEM).

To print it or save it as a PDF, use your browser’s print function (Ctrl + P, or ⌘ + P on a Mac).

Brume’s legal position, the GDPR articles covered and suggested wording for your records of processing are on the GDPR & compliance page.

A question about an item on this checklist? Write to Frederik

Opens your email app. Your address is only used to reply to you.