A GDPR-Compliant App: a Checklist for Business Owners

GDPR comes up with every application that stores customer or employee data - and rightly so, since mistakes can mean fines and lost trust. The good news: you do not need to be a lawyer. A GDPR-compliant app is, in practice, a list of concrete decisions you make together with your development partner before the system goes live. Below is a business owner's checklist: what to decide, what to ask about and what to tick off before launch.

Start with minimisation: what do you actually collect?

The basic GDPR rule is simple: collect only the data you need for the purpose. Go through every form field in the app and ask "what for?":

• name and address - needed to fulfil an order, fine,
• date of birth - if you do not verify age, why collect it?
• national ID numbers - in a typical business app almost never needed,
• "just in case, it might be useful" - the worst possible justification.

Less data means lower risk, simpler documentation and a cheaper build. It is worth writing these requirements down at the specification stage - see our guide on how to write an app specification.

Legal bases in plain language

Every processing of personal data needs a legal basis. In a small company four usually apply:

• Contract - you process data to deliver an order or a service.
• Legal obligation - e.g. invoice data you must keep for the tax office.
• Legitimate interest - e.g. pursuing claims or basic system security.
• Consent - newsletters and marketing; it must be voluntary, specific and easy to withdraw.

Inside the app this means, among other things: consent checkboxes unticked by default, separate consent for marketing instead of one blanket checkbox, and one-click opt-out.

Data processing agreements: contractor and hosting

If your contractor maintains the app and can access the database, they process data on your behalf - you need a data processing agreement (DPA). The same applies to your hosting and cloud providers. Check where the servers physically are: simplest when inside the EEA, and for transfers outside the EEA the provider should point to a clear legal mechanism. DPA clauses belong in the main contract - what else to watch for there is covered in our post on software development contracts.

Retention: data cannot live forever

Set a storage period for every category of data: invoice data for as long as regulations require, inactive accounts up to a defined time after the last login, logs shorter than that. The key question for your contractor: does deleting in the app really delete the data, including from backups, or does it only hide the record? Good practice includes automatic clean-up after the deadline, anonymising data kept for statistics and a documented backup expiry cycle.

User rights and the processing register

GDPR gives people concrete rights, and the app should let you handle them without digging through the database by hand:

• access and export - generating a user's data in a readable format,
• rectification - editing data from the account level,
• erasure - a procedure that deletes the account together with its data,
• access logs - you can see who on your team viewed or changed data.

On the company side, keep a register of processing activities - a simple document: what data, for what purpose, for how long and entrusted to whom. The technical side (encryption, access, backups) can be checked with the ten questions from our post on web application security.

A GDPR-compliant app: the pre-launch checklist

• every collected field has a purpose and a legal basis,
• consents are voluntary, separated and easy to withdraw,
• a signed DPA with the contractor and the hosting provider,
• servers in the EEA or a clear transfer mechanism,
• retention periods defined and automatic deletion in place,
• user data export and deletion work and have been tested,
• only the right roles can access data, and operations are logged,
• a privacy policy written in plain language,
• you know what to do in case of a breach: whom to notify and how fast.

Tick this list off with your contractor at handover - and ideally put it into the specification before you even ask for quotes.

Disclaimer: this article is a practical guide to the decisions worth making with your development partner - it is not legal advice. For non-standard cases, consult a lawyer specialising in data protection.

Planning an app and want GDPR taken care of from the first sprint? Book a technical consultation or describe your project in our quote calculator - you will see a ballpark price range on the spot, get a first reply within 24 hours, and receive a binding quote after a short call.