Data protection in an app: what the GDPR asks of its design

If your application handles personal data (customers, patients, students, employees), the General Data Protection Regulation affects it from the design stage, not only when you write the privacy policy. This guide sums up what to bear in mind when commissioning an app. It is no substitute for legal advice: your company is responsible for the processing, and it is worth reviewing with your adviser.

The principles that most affect design

• Data minimisation: ask only for the data you need for the purpose. Every extra field is an extra risk.
• Purpose limitation: data is used for what you said when collecting it, not for something else without a legal basis.
• Storage limitation: decide how long you keep each piece of data and make the app delete or anonymise it afterwards.
• Security: technical and organisational measures appropriate to the risk of the data.
• Privacy by design and by default: the most protective options switched on without the user having to look for them.

What to decide before building

• Which data you collect and on what legal basis: contract, consent, legal obligation or legitimate interest.
• Whether you handle special category data, such as health data, which needs more care and often an impact assessment.
• Which providers are involved (hosting, email, payments, AI) and where they are: each needs a data processing agreement.
• How you will handle users’ rights: access, rectification, erasure, portability or objection.

Technical measures worth asking for

• Role-based access: each person sees only what they need for their work.
• A log of access to sensitive data, to know who looked at what and when.
• Encryption in transit always, and at rest for sensitive data.
• Hosting in the European Union, or adequate safeguards if a provider is outside it.
• Exporting and deleting a person’s data from the admin panel, to handle their rights without depending on a technician.
• Encrypted backups with a defined retention period.

Common mistakes

• Keeping data “just in case” and never deleting it.
• Using third-party tools (analytics, chat, forms) without checking what data they receive and without the necessary consent.
• Sharing one admin account between several people.
• Leaving real data in unprotected test environments.

In our projects we design with role-based access, access logs and EU hosting, and we help you document the technical measures so your adviser can complete the legal analysis.

How we build your application