8.6Compliance Requirements

Regulation	Impact on Testing
GDPR	Test environments must use masked data; verify deletion removes all references
HIPAA	No real patient data in test environments, ever
PCI DSS	Test with valid-format but fake card numbers (4111...)
SOC 2	Access to production data must be audited; masked data reduces audit scope
CCPA	Similar to GDPR — California residents' data must be protected

GDPR-Specific Tests

def test_gdpr_deletion_removes_all_references(api, db):
    """GDPR right to erasure: deleting a user removes ALL their data."""
    # Create a user with orders and activity
    user = create_user_with_full_history(api)

    # Request deletion (GDPR right to erasure)
    api.delete(f"/users/{user['id']}/gdpr-delete")

    # Verify complete removal
    cursor = db.cursor()

    cursor.execute("SELECT * FROM users WHERE id = %s", (user["id"],))
    assert cursor.fetchone() is None, "User record still exists"

    cursor.execute("SELECT * FROM orders WHERE user_id = %s", (user["id"],))
    assert cursor.fetchone() is None, "User orders still exist"

    cursor.execute("SELECT * FROM audit_log WHERE user_id = %s", (user["id"],))
    assert cursor.fetchone() is None, "User audit trail still exists"

    cursor.execute("SELECT * FROM session_logs WHERE user_id = %s", (user["id"],))
    assert cursor.fetchone() is None, "User session logs still exist"