GDPR for software teams
What the GDPR asks of software that handles personal data of people in the EU, from lawful basis and data rights to privacy by design, breach notice and transfers.
What GDPR is
Regulation (EU) 2016/679, the General Data Protection Regulation
The GDPR is the EU's data protection law, Regulation (EU) 2016/679. It has applied since 25 May 2018. It sets rules for processing personal data: any information about an identified or identifiable person, from a name or email to an IP address or a device ID.
It splits responsibility by role. The controller decides why and how data is processed. The processor handles data on the controller's behalf, as most SaaS vendors do for their business customers. Both have duties, and processors work under a written contract.
The UK keeps its own version, the UK GDPR, alongside the Data Protection Act 2018. The duties are close to the EU text, but the regulator, transfer rules and some details differ.
Who it applies to
Organisations in the EU
Any controller or processor established in the EU, for processing in the context of that establishment, wherever the data is stored.
Organisations outside the EU
Companies elsewhere that offer goods or services to people in the EU, or monitor their behaviour there, such as tracking or profiling (Article 3).
Processors and sub-processors
Software and infrastructure vendors that handle personal data for a customer, and their own vendors down the chain.
The GDPR does not care where your servers are. A US company with EU users is covered, and an EU company hosting in the US still is. Anonymous data falls outside it, but pseudonymised data, where a key can link it back, is still personal data.
Key requirements, and what they mean for the build
Each row links the official text. Read the source for the exact wording before you rely on it.
Principles
Lawful, fair and transparent processing, for set purposes, with as little data as needed, kept accurate, kept no longer than needed and kept secure. You must be able to show it (accountability).
A data inventory that records, per field, why it is collected, how long it is kept and where it goes.
Lawful basis and special categories
Every processing needs one of six legal bases. Health, biometric and other special-category data need an extra condition.
Record the basis per purpose. Where it is consent, store who agreed to what version and when, and make withdrawal as easy as giving it.
Data subject rights
Access, rectification, erasure, restriction, portability, objection, and rights around solely automated decisions. Answer within one month.
Self-serve export and deletion that reach every service and processor, plus a queue to track requests against the deadline.
Data protection by design and by default
Build data protection into the design, and make the most private setting the default.
Collect less, pseudonymise early, default sharing and tracking to off, and limit who can see personal data in the product.
Processor contracts
Controllers use only processors that give sufficient guarantees, under a contract (a DPA) with set terms. Processors need approval for sub-processors.
Keep a public sub-processor list and a way to tell customers before it changes.
Records of processing
Keep a record of processing activities: purposes, categories of data and people, recipients, transfers and retention.
Generate the record from the data inventory so it stays true as the system changes.
Security of processing
Security suited to the risk, such as pseudonymisation, encryption, resilience, restore ability and regular testing.
Encryption at rest and in transit, least-privilege access, backups with tested restores and regular security testing.
Breach notification
Tell the supervisory authority within 72 hours of becoming aware of a breach, where feasible, and tell affected people when the risk to them is high.
Detection and audit logs good enough to scope a breach fast, and a runbook that starts the 72-hour clock.
Data protection impact assessment
Assess high-risk processing before it starts, such as large-scale special-category data, systematic monitoring or profiling.
Run a DPIA as part of design for features like scoring, tracking or AI decisions, and keep it with the design docs.
International transfers
Personal data can leave the EU only with a safeguard: an adequacy decision, standard contractual clauses or another listed mechanism.
Know which region each service and processor runs in, and offer EU hosting where customers need it.
Engineering controls for GDPR
How the rules change the way the software is designed.
- 01
Data inventory
Every personal data field with its purpose, legal basis, retention period and the services it flows to.
- 02
Consent records
When consent is the basis: who agreed, to which version of the text, when, and when they withdrew.
- 03
Export and erasure
One action that finds a person's data across databases, files, search indexes and processors, and exports or deletes it.
- 04
Retention jobs
Scheduled deletion or anonymisation when the retention period ends, with a log that shows it ran.
- 05
Pseudonymisation
Analytics and AI work on pseudonymised IDs, with the mapping kept apart and access to it limited.
- 06
Private defaults
Optional tracking, sharing and profiling off until the person turns them on.
- 07
Region-aware hosting
Know where every service and processor runs, and keep EU data in the EU where contracts ask for it.
- 08
Breach readiness
Access logs, alerts and a runbook so a breach can be scoped and reported within 72 hours.
What to watch
Cookies and similar tracking are covered by a separate law, the ePrivacy Directive, as written into each EU country's national law. Plan consent banners with both in mind.
Checked against the official sources on 2026-10-25.
140 OceanLab product builds cite GDPR
Counted from our published case studies: a build counts when GDPR is in the list of rules it was built for.
Acequia - Multi-country Payroll Console Over Four Local Engines
Designed and built a clickable payroll orchestration console for a Madrid engineering group paying about 1,550 people in Spain, Portugal, Italy and Morocco: one tracker for every country's run from input cut-off to paid and filed, validation and variance review before approval, and payment batches that only a second person can release.
Allmend - Tokenisation Platform for Funds, Property and Private Credit
Designed and built a clickable tokenisation platform for a Vaduz token issuer registered under the TVTG: permissioned tokens for fund units, real estate SPV shares and private credit notes, with every on-chain operation approved under a signing policy, every investor transfer checked before it settles, and the token ledger kept in step with the legal register.
Baken - Lab Results Portal with Critical Value Calls and Read-Back
Designed and built a clickable lab console for an ISO 15189 accredited laboratory in Zuid-Holland: follow every order and sample from collection to storage, read validated results with flags, EUCAST susceptibility and release state, and phone critical values against a deadline with a logged call chain and a read-back check.
Avli - Listings and Agent CRM for a Cypriot Estate Agency
Designed and built a clickable listings and agent CRM for a Cypriot sales and lettings agency with 22 branches and about 180 agents: listings with EPC and agency agreement checks, portal syndication, a lead pipeline with response timers, offers that wait for AML clearance, and a progression checklist from reservation to transfer of title.
Lotse - Open Banking Aggregator Operations Console
Designed and built a clickable operations console for a Hamburg account information service provider that connects fintechs to German bank accounts under PSD2: bank connector health, incidents, and every consent from grant to the 180-day re-authentication.
Keystep - Digital Bank Onboarding with ID, Liveness and Risk-Based Review
An onboarding platform for an Irish digital bank: applicants open a EUR current account from their phone with ID and selfie liveness checks, and a staff console lets onboarding and financial crime teams review the cases the rules cannot decide, through to an issued Irish IBAN.
Check your product
Other frameworks and industries
Build with GDPR in mind from day one
Project build
We design and build the system as one project. It starts with a clickable prototype your team tries before any production code is written. Pay per milestone (outcome-based) or hourly at $30-50/hr, depending on role and seniority.
Embedded engineers
Our engineers join your team on a flexible monthly retainer. Part-time is fine and it runs month to month, with hours that overlap the US, UK and Europe, the Middle East, and Australia and Asia. Outcome-based or $30-50/hr.
GDPR questions
Does the GDPR apply to a company outside the EU?
Yes, if it offers goods or services to people in the EU or monitors their behaviour there. It does not matter where the company or its servers are.
Do we have to host data in the EU?
Not by law. Transfers out of the EU are allowed with a safeguard such as an adequacy decision or standard contractual clauses. Many enterprise customers still ask for EU hosting in their contracts.
How does erasure work with backups?
Regulators generally accept that backups cannot be edited record by record. A common approach is to delete from live systems, keep backups on a fixed expiry, and make sure deleted data is not restored back into use.
We are adding AI features. What changes?
Check the legal basis for using personal data to train or run the model, run a DPIA if the feature profiles people or makes decisions about them, and give people a way to get human review of significant automated decisions. The EU AI Act adds its own duties on top.
