unit U4 — 4 of 4

GDPR-safe routing

PII minimisation before third-party hops

Automation pipelines move personal data — names, emails, phone numbers, sometimes far more — and every third-party step you route through is a place that data now lives. Under GDPR you’re accountable for each hop: an enrichment API, an LLM call, a logging vendor. Minimisation is the rule that keeps you defensible — send each downstream only the fields it genuinely needs, and nothing more. A scoring model needs the deal size, not the buyer’s home address.

Build the pipeline so PII is stripped or masked at the boundary. An Edit Fields step right before an external HTTP Request Piece should project only the required keys; a Code Piece can hash identifiers you need for correlation but not in plaintext. Keep a lawful basis for each hop, prefer EU-region endpoints for EU data, and never let raw PII land in a debug log that ships to a third-party observability vendor.

Where it breaks: the convenience of passing the whole record. Mapping the full webhook payload straight into an enrichment API is one drag of a connection — and it exfiltrates every field to a processor you may have no agreement with.

worked example

Projecting a minimal, masked payload before an external enrichment call in a Code Piece.

import { createHash } from 'node:crypto';

export const code = async (inputs) => {
  const lead = inputs.lead;
  return {
    // only what the enrichment API needs — no name, phone, or address
    domain: lead.email.split('@')[1],
    dealSize: lead.dealSize,
    region: lead.region,
    // correlation ref, hashed so the vendor never sees the raw email
    ref: createHash('sha256').update(lead.email).digest('hex').slice(0, 16),
  };
};

field checklist

Project only required fields before every third-party step.
Mask or hash identifiers used only for correlation.
Prefer EU-region endpoints when processing EU personal data.
Keep raw PII out of logs sent to external vendors.
Record a lawful basis for each external hop you make.

common failure — Whole payload leaked to an enrichment API

A flow piped the full lead record — name, phone, home address — into a US enrichment vendor just to fetch a company size. Only the email domain was needed. The extra fields became an unlawful cross-border transfer with no processing agreement. Insert an Edit Fields step projecting the minimal shape immediately before any external call, and audit every outbound HTTP Request Piece for over-sharing.

check your understanding

An enrichment API needs only a company size, derived from the email domain. Which outbound payload is defensible under GDPR minimisation?

sandbox validation

The check above confirms you followed the unit. Marking the module COMPLETED takes more: build the automation in your own engine and submit the exported flow and its run evidence, signed, to your unique validation URL. See the module page for that spec.