GDPR for Developers and Software Architects

Bruce

Bruce

4 min read

GDPR is all about protecting people's information in the digital cyber space. What does it mean to developers? What is personal data?

Important Note: This article does not constitute legal advice.

GDPR applies to all businesses, organizations, sectors, situations, and scenarios, regardless of a business's size, head count, or financial turnover. Personal data can be every piece of data that can be used to uniquely identify a person.

What is personal data

Sensitive personal data
  • Racial or ethnic origin
  • Political opinions
  • Religious or philosophical beliefs
  • Trade union membership
  • Health data
  • Sex life or sexual orientation
  • Past or spent criminal convictions
Regular personal data
  • Genetic data
  • Biometric data
  • Location data
  • Pseudonymized data
  • Online identifiers: Email address, IP address, mobile device ID, browser fingerprint, RFID tag, MAC address, cookies, user account ID

People's right of personal data

  • The right to be forgotten
  • The right to erasure
  • The right to restriction of processing
  • The right to data portability
  • The right to rectification
  • The right to be informed
  • The right of access

Data security by design and best security practice

GDPR to the developers and architects means implementing good security measures and good security principles.

Implementing secure web servers and infrastructure Servers should be properly restricted using Bastion host and firewall. Access to the servers should be auditable. If you are looking for security review or like to enhance the security of your website or servers, please check Managed Cloud service.

Always upgrade software packages It is a best practice for security to keep the software packages version up-to-date.

Integrity and confidentiality Implementing HTTPS and SSL data encryption for personal data transit. Implementing password and encryption for client files. Pseudonymisation for the testing environment or staging environment.

Data encryption by default Don't store sensitive personal data in the database with plaintext, Encrypt the data entities with keys or password. Obfuscate the personal data such as user address, bank account etc.

If you are a Transfon PHP Encoder customer, you would be able to use the build-in encrypt and decrypt functions for the transparent sensitive data encryption and decryption.

Keep data storage safe Enable the data encryption on the server disk. Enable FileVault if you use MacOS. Enable data encryption at your backup storage such as AWS S3 or offline storage.

Keep application layer secure Protect your application and business logics with PHP Encoder (if your application is built with PHP) from the modification even the server is accessed unauthorized.

Logging and auditable personal data access Log the access to personal data at all layers from a server to application, database.

Data minimization principle

Only collect and process the data necessary for the application or business logic. Keeping data for no longer than necessary.

Data retention and deletion

Data retention and deletion schedules for all the personal data you hold.

Should be able to find, delete, export all the data related to one user by user ID.

But it is fine to keep all purchasing records for ten years for tax and auditing purposes if you are an e-commerce company, just keep the process on the record.

Product features related to GDPR

These are some product features you can add for GDPR:

Close the account Erasure all the data related to the user; Notify the third party to close account and erasure the data

Restrict processing Able to restrict the access from back-office staff, or publicly

Export data Export data of the user

Profile fields for Consent checkboxes Enable users to change profile and fields

Re-request consent Enable users to be informed of the consent

Age checks Ensure the user is at least 16 years old. The processing of the personal data of a child shall be lawful where the child is at least 16 years old.