tutorials

Key: GDPR applies to all organizations processing EU personal data; DORA applies specifically to EU financial entities

Key: Row-Level Security enables data isolation without application-level workarounds — critical for multi-tenant SaaS in finance

Key: Data classification is required by ISO 27001 (A.8.2) and strongly recommended for GDPR Article 5 compliance

Key: DORA enforcement is active since January 2025 — financial entities face audits from national competent authorities

Key: Using production PII in dev/staging is a GDPR violation — even internal access counts

Key: SOC 2 Type II requires evidence over a period — not a point-in-time snapshot

Key: Schema drift is the number one cause of incomplete GDPR deletion requests

Key: Manual compliance (spreadsheets, scripts) breaks down beyond 5 tables and 2 engineers

Key: SaaS compliance tools require external data access — problematic for sovereignty-sensitive organizations

Key: Fintech must comply with both GDPR (data protection) and DORA (operational resilience) simultaneously

Key: Minimum viable compliance has five pillars: know, delete, prove, protect, clean

Key: EU public sector increasingly mandates open-source software — pgcomply is Apache 2.0

Key: Auditors frequently ask about historical state — 'what was true at time X?'

Key: Manual compliance checks get forgotten — automate everything that can be automated

Key: Run schema_drift() after every migration to catch new unregistered PII columns

Key: quick_setup() is one command that scans, classifies, and reports on your entire database