When working with personal data, what requirements would you prioritize in the system?

When working with personal data, it is first necessary to ensure security and compliance with legislation (for example, GDPR or Federal Law-152 in Russia). The main requirements for the system:

• Data encryption: both at rest and in transit — using TLS, AES, and other proven algorithms.
• Authentication and authorization: strict access control, minimizing user and service rights.
• Logging and auditing: record access and changes to data for subsequent analysis.
• Consent management: store and verify user consents for data processing.
• Data minimization: collect and store only necessary data.
• Backup and recovery: to prevent data loss.
• Updates and patches: timely updating of components to fix vulnerabilities.

Example in Go for data encryption using AES:

package main

import (
    "crypto/aes"
    "crypto/cipher"
    "crypto/rand"
    "io"
    "log"
)

func encrypt(data []byte, key []byte) ([]byte, error) {
    block, err := aes.NewCipher(key)
    if err != nil {
        return nil, err
    }
    ciphertext := make([]byte, aes.BlockSize+len(data))
    iv := ciphertext[:aes.BlockSize]
    if _, err := io.ReadFull(rand.Reader, iv); err != nil {
        return nil, err
    }
    stream := cipher.NewCFBEncrypter(block, iv)
    stream.XORKeyStream(ciphertext[aes.BlockSize:], data)
    return ciphertext, nil
}

func main() {
    key := []byte("example key 1234") // 16 bytes for AES-128
    data := []byte("personal data")
    encrypted, err := encrypt(data, key)
    if err != nil {
        log.Fatal(err)
    }
    log.Printf("Encrypted data: %x", encrypted)
}