GDPR compliance inside Workplace, where the data never stops moving

Workplace.com holds the internal communications of a very large number of organisations. Every piece of that data is subject to GDPR, and at Meta's scale compliance is not a policy document — it is code, running on a schedule, provably doing what it claims.

The work sat where data management, privacy law and internal systems meet. Getting it wrong is not a bug report; it is a regulatory event.

We built and maintained integrations with Meta's database management solutions, developing the workflows in PHP and in Hack — Meta's own language, which you learn on the job because there is nowhere else to learn it.

Most of the engineering was in making data processing legible: optimising how data moved between internal systems, and ensuring the seams between them held. We worked directly with compliance teams, not through a translation layer, because the requirement and the implementation had to be checked against each other continuously.

Data workflows that satisfied both GDPR requirements and Meta's internal review standards — which are, in practice, the harder of the two.

This is where our review discipline comes from. At Meta, code review, testing and performance budgets are the cost of entry rather than a nice-to-have. That standard is what we now apply to AI-assisted work, and it is why we can move quickly without breaking things quietly.