Module 11 Lesson 5: Compliance & Privacy

When you automate "Personal Data" (Names, Emails, Medical Info), you enter the world of Compliance. Following GDPR (EU) or HIPAA (US) is not optional.

1. Data Minimization (The #1 Rule)

Only process the data you need.

• Bad: Downloading a user's entire profile from HubSpot just to send them a greeting.
• Good: Using a Set Node (Module 3) to immediately "Delete" the user's birthdate and SSN once the initial verification is done.

---

2. Privacy by Design in n8n

• No Logging for Sensitive Data: In the node settings, you can check "Don't Save Execution Data".
• This means the node will run, but the data will NEVER be saved to the n8n database. This is a "Must-Have" for password resets or medical record handling.

---

Visualizing the Process

graph TD
    Start[Input] --> Process[Processing]
    Process --> Decision{Check}
    Decision -->|Success| End[Complete]
    Decision -->|Retry| Process

---

3. Anonymization & Hashing

If you want to track "How many users signed up" without knowing "Who" they are:

1. Get User Email.
2. Use the Crypto Node (Module 3) to create a Hash (e.g., SHA256) of the email.
3. Save ONLY the hash to your analytics Google Sheet.

• You can now identify if the same user returns later, but you don't actually know their email.

---

4. Right to be Forgotten

If a user asks to be deleted:

• You should have an n8n workflow that triggers on "Account Deletion" and automatically goes to HubSpot, Mailchimp, and your Postgres DB to remove every trace of that user.

---

Summary of Module 11

Security Layer	Goal
User Roles	Prevent accidental usage.
Webhook Auth	Block external hackers.
Encryption Keys	Protect the database.
Audit Logs	Provide a paper trail.
Privacy Gates	Follow the law.

---

Exercise: The Privacy Officer's Review

1. Why is "Self-hosting" (Module 1/2) a major advantage for GDPR compliance?
2. Create a workflow that "Hashes" a string and compares it to a previous hash.
3. If your company is audited, how would you show where a specific user's email was sent?
4. Research: What is "Data Processing Agreement (DPA)" and do you need one with n8n.io if you use their Cloud?
5. Search: How to "Purge" old automation data from the database using a scheduled command.

---

Summary

You have completed Module 11: Security and User Management. You have moved beyond simple automation and into the world of Enterprise Governance. You build workflows that are not only efficient but also safe, legal, and trusted by your organization.

Next Module: The final test: Module 12: Capstone Project: Automated Business Assistant.