GDPR Article 25 Data Minimization in RAG: Engineering Compliance Guide

import OpenAI from 'openai';
import { sanitize, restore } from '@privacyscrubber/sdk';

const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });

// Ingestion Pipeline: Customer Support Ticket
const rawCustomerTicket = 'User Claire Dubois (claire.dubois@paris-tech.fr, +33 1 42 68 55 00) reports invoice discrepancy #INV-9921.';

// 1. Enforce Data Minimization in local memory before RAG processing (<0.8ms)
const { scrubbedText, tokenMap } = sanitize(rawCustomerTicket, {
  profile: 'General'
});

// 2. Vectorize and process ONLY the pseudonymized payload (Zero PII egress)
console.log('Sanitized Payload for Vector Embeddings & LLM:');
console.log(scrubbedText);

// 3. Safely summarize ticket via LLM:
const completion = await openai.chat.completions.create({
  model: 'gpt-4o',
  messages: [{ role: 'user', content: `Summarize support ticket:\n\n${scrubbedText}` }]
});
const rawSummary = completion.choices[0].message.content || '';

// 4. Reverse only when serving verified data subjects in authorized sessions:
const authorizedOutput = restore(rawSummary, tokenMap).restoredText;
console.log('\nAuthorized Output for Support Agent:');
console.log(authorizedOutput);