The most expensive way to handle GDPR is retroactively: an audit finds problems, a lawyer writes an opinion, and developers rework a finished system. Privacy by design means making seven decisions at the start — most of them free.
Seven decisions before the first line
1. Minimisation: collect only fields you can justify with a purpose. 2. Retention: every table with personal data has a deadline and automatic deletion. 3. Access: roles and logs from day one, not “we'll add it later”. 4. Export: the right to portability means a button, not three days of manual work. 5. Anonymised test data — a production database on developers' laptops is a time bomb. 6. Encryption at rest and in transit. 7. Processing agreements with every third-party service, analytics included.
What the business gets besides peace of mind
Paradoxically, faster development: a system with clear roles and retention is easier to test and extend. And a sales edge with corporate clients — their procurement sends GDPR questionnaires, and the vendor with ready answers wins tenders.
AI and GDPR: a new layer to ask about
With AI came the question of where your data flows when a model processes it. The answer should not be “to someone else's cloud, and we'll see”: sensitive data is anonymised before sending or processed locally, and every AI service is covered by a processing agreement. Privacy by design today also means “AI by design” — thought through before the first prompt leaves the company.
What to do about a breach — before it happens
GDPR gives you 72 hours to report a breach. Without a prepared procedure those hours are wasted in panic, and the company is fined not for the breach but for the chaos after it. A ready plan — who decides, how the scope is established, how people are informed — turns a crisis into a managed incident. The best time to write it is before you need it.
Our standard: a privacy checklist is part of every discovery phase, and GDPR documentation at handover is included in the price, not an extra invoice.