6 min
GDPR before shipping an app: the short list
Not the full audit. The five technical checks that, if missing, guarantee trouble later on.
Before opening an application to the public there is a long compliance list that a legal professional reviews. And there is a short, technical list that the development team can and should check on its own.
- Personal data inventory. Which personal fields you store, for what, and where they end up (database, logs, transactional email, analytics, backups). If you do not have it written down, you cannot reason about the risk.
- Real deletion. There is a way to fully remove a person with no manual script. It includes backups and logs, with a defined retention policy.
- Export. You can hand a person all of their data in a readable format, without rebuilding it by hand.
- Vendor contracts. A signed DPA with every external service that touches personal data, and the processing location identified (inside or outside the EU).
- Security minimums. Encryption in transit and at rest, role-based access, logging of access to sensitive data and a written plan for a breach (72 hours to notify).
The detail of each point — legal basis, processors, privacy by design — is in the guide to privacy and GDPR in software projects.
- GDPR
- Privacy
- Production
Related guides
Next step
Half an hour well spent
Walk us through the problem on a short call. You leave with a first read on how we'd approach it and what it would involve — no commitment, no sales deck.