{"head":{"title":"GDPR for Software Teams: Duties and Controls | OceanLab","description":"What the GDPR means for software: who it applies to, data subject rights, privacy by design, breach rules and transfers, with the engineering controls.","canonical":"https://oceanlab.in/compliance/gdpr"},"slug":"gdpr","stats":{"builds":140,"industries":58,"countries":59},"featured":[{"meta":{"slug":"acequia","industry":"hr","projectType":"Multi-country payroll","country":"es","tags":["enterprise"],"compliances":["GDPR","Law 09-08 (Morocco)","EU Pay Transparency Directive","SEPA Credit Transfer (ISO 20022)","Sistema RED and modelo 111 (Spain)","Segurança Social and DMR (Portugal)","F24, UniEmens and LUL (Italy)","CNSS and IR (Morocco)"],"cover":{"src":"/case-studies/acequia/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Acequia - Multi-country Payroll Console Over Four Local Engines","description":"Designed and built a clickable payroll orchestration console for a Madrid engineering group paying about 1,550 people in Spain, Portugal, Italy and Morocco: one tracker for every country's run from input cut-off to paid and filed, validation and variance review before approval, and payment batches that only a second person can release.","category":"HR & Payroll / Multi-country Payroll","client":"Carrasca Ingeniería"}}},{"meta":{"slug":"allmend","industry":"defi","projectType":"Tokenised real-world assets","country":"li","tags":["defi","web3","fintech","enterprise"],"compliances":["TVTG (Blockchain Act)","MiCA","MiFID II","EU Prospectus Regulation","AIFMD","FinSA","SPG (Due Diligence Act)","GDPR","ERC-3643"],"cover":{"src":"/case-studies/allmend/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Allmend - Tokenisation Platform for Funds, Property and Private Credit","description":"Designed and built a clickable tokenisation platform for a Vaduz token issuer registered under the TVTG: permissioned tokens for fund units, real estate SPV shares and private credit notes, with every on-chain operation approved under a signing policy, every investor transfer checked before it settles, and the token ledger kept in step with the legal register.","category":"Crypto & DeFi / Tokenised Real-World Assets","client":"Falkenau Token AG"}}},{"meta":{"slug":"baken","industry":"clinics","projectType":"Lab results portal","country":"nl","tags":["healthcare","enterprise"],"compliances":["GDPR (AVG) and UAVG","WGBO","Wabvpz","Wegiz","Wbsn-z","NEN 7510","NEN 7512","NEN 7513","ISO 15189","MedMij"],"cover":{"src":"/case-studies/baken/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Baken - Lab Results Portal with Critical Value Calls and Read-Back","description":"Designed and built a clickable lab console for an ISO 15189 accredited laboratory in Zuid-Holland: follow every order and sample from collection to storage, read validated results with flags, EUCAST susceptibility and release state, and phone critical values against a deadline with a logged call chain and a read-back check.","category":"Healthcare / Lab Results Portal","client":"Duinhof Medisch Laboratorium"}}},{"meta":{"slug":"avli","industry":"realestate","projectType":"Listings & agent CRM","country":"cy","tags":["enterprise"],"compliances":["Real Estate Agents Law 2010","Cyprus AML Law 2007","EU EPBD (EPC)","GDPR","Law 125(I)/2018","ePrivacy"],"cover":{"src":"/case-studies/avli/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Avli - Listings and Agent CRM for a Cypriot Estate Agency","description":"Designed and built a clickable listings and agent CRM for a Cypriot sales and lettings agency with 22 branches and about 180 agents: listings with EPC and agency agreement checks, portal syndication, a lead pipeline with response timers, offers that wait for AML clearance, and a progression checklist from reservation to transfer of title.","category":"Real Estate / Listings & Agent CRM","client":"Lemonokipos Estates"}}},{"meta":{"slug":"lotse","industry":"banking","projectType":"Open banking aggregator","country":"de","tags":["fintech","saas","enterprise"],"compliances":["PSD2","ZAG","PSD2 RTS on SCA","eIDAS","GDPR","BDSG","DORA"],"cover":{"src":"/case-studies/lotse/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Lotse - Open Banking Aggregator Operations Console","description":"Designed and built a clickable operations console for a Hamburg account information service provider that connects fintechs to German bank accounts under PSD2: bank connector health, incidents, and every consent from grant to the 180-day re-authentication.","category":"Banking / Open Banking","client":"Elbtal Konto GmbH"}}},{"meta":{"slug":"keystep","industry":"banking","projectType":"Digital bank onboarding","country":"ie","tags":["fintech","mobile","saas","enterprise"],"compliances":["EU AML Directives","CJA 2010 (Ireland)","EBA/GL/2022/15","EU sanctions","CRS / FATCA","GDPR","Payment Accounts Directive","Consumer Protection Code","PSD2 SCA"],"cover":{"src":"/case-studies/keystep/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Keystep - Digital Bank Onboarding with ID, Liveness and Risk-Based Review","description":"An onboarding platform for an Irish digital bank: applicants open a EUR current account from their phone with ID and selfie liveness checks, and a staff console lets onboarding and financial crime teams review the cases the rules cannot decide, through to an issued Irish IBAN.","category":"FinTech / Digital Banking","client":"Corrib Bank"}}}],"all":null,"byIndustry":[{"id":"ai","label":"AI agents & automation","href":"/case-studies/industry/ai","count":6},{"id":"ecom","label":"E-commerce & D2C","href":"/case-studies/industry/ecom","count":5},{"id":"regtech","label":"RegTech & compliance","href":"/case-studies/industry/regtech","count":5},{"id":"travel","label":"Travel & hospitality","href":"/case-studies/industry/travel","count":5},{"id":"gaming","label":"Gaming","href":"/case-studies/industry/gaming","count":4},{"id":"hr","label":"HR & payroll","href":"/case-studies/industry/hr","count":4},{"id":"internal","label":"Internal tools & ops","href":"/case-studies/industry/internal","count":4},{"id":"mobility","label":"Mobility & EV","href":"/case-studies/industry/mobility","count":4},{"id":"banking","label":"Banking & lending","href":"/case-studies/industry/banking","count":3},{"id":"clinics","label":"Hospitals & clinics","href":"/case-studies/industry/clinics","count":3},{"id":"data","label":"Data & analytics","href":"/case-studies/industry/data","count":3},{"id":"energy","label":"Energy & utilities","href":"/case-studies/industry/energy","count":3}]}