GDPR in software development: privacy by design, without the legal theatre

The most expensive way to deal with GDPR is after the fact: an audit finds problems, a lawyer writes an opinion and developers rework a finished system. Privacy by design means making seven decisions at the start. Most of them cost nothing.

Seven decisions before the first line of code

1. 01Minimisation: collect only data you can justify by its purpose.
2. 02Retention: every record of personal data has a time limit and automatic deletion.
3. 03Access: roles and access logs from day one, not “we’ll add them later”.
4. 04Export: the right to data portability should be a button, not three days of manual work.
5. 05Test data: anonymised. A live database on developers’ machines is a time bomb.
6. 06Encryption: in transit and at rest.
7. 07Processor agreements: with every third-party service, including analytics.

In custom software development, these decisions are made in the design, not at handover.

What the company gets besides peace of mind

Paradoxically, faster development, because a system with clear roles and time limits is easier to test and extend. And a commercial advantage with large clients: their procurement departments now send data protection questionnaires, and a vendor with ready answers has a head start.

AI and GDPR: a new layer to ask about

With the rise of AI comes the question of where your data flows when a model processes it. The answer shouldn’t be “to someone else’s cloud, and we’ll see”. Sensitive data should be anonymised before sending or processed locally, and every AI service should be covered by a data processing agreement. Privacy by design now includes AI too: think it through before the first question to a model leaves the company.

What to do in a breach — before it happens

GDPR gives you 72 hours to report a breach. Without a prepared procedure, those hours are wasted in panic, and the company gets into trouble not because of the breach itself but because of the chaos afterwards. A prepared plan — who decides, how the extent is established and how people are informed — turns a crisis into a managed incident. The best time to write it is before you need it.

Ask your vendor whether data protection is part of the initial design and whether GDPR documentation is part of the handover. With us, data is stored in the EU, with AI you know in advance which data goes where, and a data processing agreement under Art. 28 GDPR is a standard part of the collaboration.