How do you handle personal data in the projects you build?

When a project handles personal data, the scope is defined before any code is written: which data is actually needed, who can access it, where it's kept, and for how long. We apply data minimization, role-based permissions, and an access log. Technical decisions are documented, so they remain verifiable later and in the event of an audit.