GDPR compliance for DynamoDB queries is not optional. Any query that can identify a person, even indirectly, is personal data under Article 4 of the GDPR. That means you need a runbook that enforces strict query limits, data minimization, and clear retention rules.
A DynamoDB query runbook for GDPR should start with access control. Define IAM roles with least privilege. Make sure queries are parameterized, not ad hoc, to prevent accidental broad scans. Audit query logs regularly. Store these logs securely with lifecycle policies that expire them according to GDPR retention requirements.
Step two: implement data masking. Use projection expressions in your queries to exclude sensitive attributes unless they are absolutely required. Never pull entire items if you only need one field.
Step three: traceability. Each query must carry a request ID that you can map back to a user action or system function. This is critical for demonstrating compliance during an audit and for breach investigations.