Meta·Software Engineer·Onsite - System Design / Architecture·Senior

SeniorPrefer not to say

Jul 2026

Summary

System design round at Meta for a data engineering role. One big open-ended question about GDPR-compliant pipelines, and they really did want you to go deep on all of it, not just sketch a high-level diagram and call it done.

Questions Asked (1)

Design a data pipeline that is GDPR-compliant. Walk through how you'd handle personal data, manage user consent, support data deletion requests, and keep the system auditable.

System DesignTechnical Trade-offsData Modeling

Author's notes

I started with the pipeline architecture itself and almost forgot to anchor everything back to GDPR requirements until maybe five minutes in.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements and constraints, then propose a high-level architecture that separates personal data into a dedicated, access-controlled store with encryption and tokenization. Walk through the lifecycle: consent capture, data processing with purpose limitation, deletion via crypto-shredding or cascading deletes, and audit logging. Emphasize trade-offs between compliance, performance, and cost, and how you'd validate the design.

Pro tip: Demonstrate awareness that GDPR compliance is not just technical but also organizational—mention data protection impact assessments (DPIAs), records of processing, and the role of a Data Protection Officer. Also, highlight that you'd design for deletion from the start rather than bolting it on later.

1. Clarify Requirements and Scope

Ask about data types, user scale, retention policies, and regulatory specifics (e.g., GDPR, CCPA). Confirm non-functional requirements like latency, availability, and audit granularity.

2. Design Data Storage and Access

Propose isolating personal data in a dedicated store with encryption at rest and in transit, tokenization/pseudonymization, and strict IAM. Use separate keys per user for crypto-shredding.

3. Implement Consent Management

Design a consent service that records user consent with timestamps, purpose, and version. Enforce consent checks at data ingestion and processing points, and allow easy withdrawal.

4. Handle Data Subject Rights (Access, Deletion, Portability)

Build APIs for access and deletion requests. For deletion, use crypto-shredding (delete encryption keys) or cascading deletes across derived data. Ensure portability by exporting data in a common format.

5. Ensure Auditability and Monitoring

Log all access and modifications to personal data in an immutable audit log. Implement monitoring and alerts for anomalous access, and regularly test deletion and consent flows.

Key Points to Mention

Data minimization and purpose limitation: only collect and process data necessary for specified purposes.
Encryption and tokenization: protect data at rest and in transit, and use pseudonymization to reduce risk.
Consent management: capture, store, and enforce consent, with easy withdrawal and versioning.
Right to erasure: implement crypto-shredding or cascading deletes, and handle derived data and backups.
Auditability: maintain immutable logs of data access and processing, and support audit trails for compliance.
Trade-offs: discuss performance impact of encryption, cost of storage for audit logs, and complexity of deletion across distributed systems.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.