GDPR Explained for Developers

TL;DR: The European Union's General Data Protection Regulation (GDPR) establishes data privacy and security measures for EU citizens. Compliance requires regular data breach threat assessments, staff security training, and updates to platform infrastructure to protect these newly established rights.

The most comprehensive international data privacy and protection standard is the European Union's General Data Protection Regulation, which outlines protection policies for EU citizens. Even companies outside the EU choose to become GDPR compliant for various reasons.

Chief among them, data breaches are costly. Recovering platform integrity, loss of proprietary software, and the costs of rapidly expanding data security measures are one side of these costs, but there are also fines, lawsuits, loss of certifications, and reputation damage to contend with as well.

Maintaining a higher data security standard further improves platform response in the event of a breach and allows businesses to operate for a global audience.

Here, we'll cover who must be compliant under GDPR, how it might alter your development pipeline, and why you might care about GDPR standards regardless of the type of information collected and processed by your platform.

Before you continue: This isn't legal advice. You should consult with legal counsel to ensure you're implementing GDPR properly for your circumstances.

Who must become compliant with GDPR?

The GDPR covers data collected from citizens of any European Union Member State. Each member state has its own governing institution that cooperates with the others to prosecute institutions found to violate the GDPR.

While the GDPR does not explicitly cover international organizations, companies may only provide data from EU citizens to these organizations if the situation or organization is deemed acceptable under GDPR standards. As such, a French firm may only provide data to a U.S. firm if that U.S. firm demonstrates compliance with the relevant sections of the GDPR.

The GDPR is known as the strongest international data protection act for a good reason - its broad definition of personally identifiable information covers a large spread of information. However, the coverage and protection differ between data types. Some notable inclusions:

• Names
• Biometric data like fingerprints and facial recognition
• Identification numbers like passport numbers, tax identifiers, and national identification numbers
• IP addresses
• Location data
• Telephone numbers

How would compliance change your workflow?

Compliance includes regular threat assessment and training that must be built into the development pipeline. The GDPR also established citizens’ rights to their data. Developers must design or adjust their platforms with these rights in mind.

Development Training and Process Assessment:

• Mandated assessment of site security: Routine assessments of site security, data processing and storage, and legal responsibilities must be built into the development flow. These assessments help identify structural weaknesses before they lead to costly breaches and keep developers up to date on their responsibilities.
• Regular security training: Regular security training for all staff helps prevent human errors that can lead to data breaches and prepares developers to take action in the event of a breach. A prepared team is a flexible one.

Rights protected by the GDPR:

• Clear consent: Consumers must be informed when and how their data is being collected and given the right to opt in and out of this collection. Make sure your development team and legal team communicate what information is and is not being collected and processed so that notices to consumers are concise and accurate.
• Rectification or erasure: Customers have the right to alter their personal information to rectify it (make it more accurate or truthful) or to erase it from the system. Technical adjustments to a platform may be necessary to provide expedient erasure or rectification capabilities.
• Right to object: Customers may object to data collection, processing, and profiling any time their data is being processed. Again, technical adjustments to data structures may be necessary to allow the expedient removal of data belonging to specific agents without disrupting other platform services.
• Portability between service providers: The consumer may ask for the transport of their data between platforms, to which the data-controlling platform must acquiesce where applicable. If this service is not already a feature, it may need to be constructed for your platform.
• Portability to third countries or international organizations: Data transfer may not occur if the third country or organization does not comply with the GDPR protection rules. Developers will need to review third-party processors that are currently part of their system. Additionally, companies not based in the EU looking to include data from EU member states must comply with the GDPR to access data under its protection.

What if my company isn't covered directly by the GDPR?

Even if your platform doesn't fall directly under GDPR regulation, building compliance strategies into your workflow can still be beneficial. The practices recommended or required by the GDPR promote a more intentional, secure development pipeline.

• International organizations looking to operate in the EU or collect/process data of EU citizens must become compliant to access these markets.
• Regular consultation with legal advisors concerning the current and future regulatory landscape, as it's relevant to your platform, can help prevent fines, lawsuits, and unexpected industry regulations.
• Compliance doesn't just have to be a tool to help bolster platform security; it can also increase a platform's reputation for safety and reliability in a competitive market.
• Despite the complex and ever-changing cybersecurity policy landscape, recent trends indicate governing bodies are listening to consumers’ desire for more robust security and privacy measures. Becoming familiar or compliant with regulations like the GDPR might help your platform transition smoothly into future regulatory conditions.

Protecting customer data is essential for building and maintaining trust. Your data is one of the most valuable parts of your organization. Did you know Doppler can help protect your data by ensuring secure access to your application secrets? Learn more about how we can help manage your API keys, tokens, and more.