Back to Blog

GDPR Guide for Software Engineers and Engineering Organizations

Published on: 2022-6-29 GDPR Guide for Software Engineers and Engineering Organizations

Recently (early 2022), the news has been full of stories about Google Analytics (specifically Universal Analytics) being declared illegal, Facebook facing fines, etc.

Suppose you are a Software Engineer or run an engineering organization. In that case, you might wonder how to avoid such compliance hurdles.

How to become compliant in these 5 EASY STEPS

Just joking. That would be misleading at best and harmful at worst.

Unfortunately, there are no easy hacks, and rather than being misleading, we will be honest.

GDPR and most legal compliance requirements can only be fulfilled with the right amount of preparation and process. Therefore, the sooner you start, the less painful these will be.

How do you start your compliance journey?

The most comprehensive and complete guide comes from what some might consider the least likely source. The French National Commission on Informatics and Liberty, CNIL.

CNIL is a French regulator that is tasked with executing privacy regulations. It is responsible for multiple high-profile rulings that made it appear on the front page of many news outlets.

Back in June 2020, CNIL published a GDPR for developers. This is a very comprehensive guide that covers a lot of details.

Sixteen steps

The guide lists 17 steps. It is a bit cheeky. The last step is marked as the sixteenth, but don't get fooled. In true developer fashion, we count from zero :)

These steps are:

  1. Develop in compliance with the GDPR
  2. Identify personal data
  3. Prepare your development
  4. Secure your development environment
  5. Manage your source code
  6. Make an informed choice of architecture
  7. Secure your websites, applications and servers
  8. Minimize the data collection
  9. Manage user profiles
  10. Control your libraries and SDKs
  11. Ensure the quality of the code and its documentation
  12. Test your applications
  13. Inform users
  14. Prepare for the exercise of people's rights
  15. Define a data retention period
  16. Take into account the legal basis in the technical implementation
  17. Use analytics on your websites and applications

I highly encourage you to dive deeper into these sections. There is a lot of information. In addition, the text is concise, approachable and engineer friendly.

This is an excellent example of a regulatory institution making a great effort to educate rather than penalize.

Do I have to go through all seventeen steps?

Yes and no.

Yes, you have to get familiar with all these steps. The good news is that assuming you adhere to modern development practices such as:

  • source code versioning,
  • change traceability,
  • project documentation,
  • testing, and
  • implementing security practices.

You are likely going to quickly tick off multiple steps straight away.

Depending on your current organizational maturity, processes and more legal aspects of your operations will be left.

There will be a few subjects that will require your further attention. These are likely:

  • questions around data retention,
  • understanding the need for data minimization,
  • getting a complete picture of how your vendors (aka Data Processors) handle entrusted information,
  • etc.

Going even further

The CNIL documents go even further, beyond GDPR. For example, section 16th covers Use analytics on your websites and applications.

The rules listed in this section pertain to the ePrivacy Directive. Directive means that it is not automatically a law, and each EU member state will adopt it with local variations.

Suppose you deploy web analytics to your website and don't ask for explicit consent. In that case, your selected solution must adhere to the following rules:

  1. To inform users of their use, for example, via Privacy Policy;
  2. To give them the ability to object to their use;
  3. To limit to the following purposes only audience measurement and or A/B testing;
  4. Not to cross-check the data processed with other processing;
  5. To limit the scope of the tracer to a single site or application editor;
  6. To truncate the last byte of the IP address;
  7. To limit the lifetime of the trackers to 13 months.

Luckily, Wide Angle Analytics ticks all the above boxes, assuming you disclose its usage in your public privacy policy.

© 2024 Input Objects GmbH. All Rights Reserved.

No AI Training allowed. No republishing without prior permission. Expand for the full text.

The content, including but not limited to text, images, graphics, and other material on this website ("Content"), is protected by copyright laws. Unauthorized use, including scraping, republishing, or use for training artificial intelligence models, is strictly prohibited without explicit written permission from Input Objects GmbH ("Company").

Notwithstanding the above, indexing of the Content by search engines for the purpose of listing in search results is permitted, provided that any displayed snippets of the Content are linked directly to the relevant page on this website and are accompanied by clear attribution to the source.

No part of the Content may be republished, distributed, or transmitted in any form or by any means, including photocopying, recording, or other electronic or mechanical methods, without the prior written permission of the Company, except in the case of brief quotations embodied in critical reviews and certain other noncommercial uses permitted by copyright law.