GDPR
The General Data Protection Regulation (GDPR) is the EU's data protection law. The UK has a near-identical copy, the UK GDPR. This page covers the parts engineers touch. Everything here is as of October 2026; check the sources on Staying current.
Official text: Regulation (EU) 2016/679 on EUR-Lex.
How it works
GDPR applies to organisations in the EU, and to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour there (Art. 3). An app on a global store that EU users can download is usually in scope.
Key terms
| Term | Plain meaning |
|---|---|
| Personal data | Any information about an identifiable person. Device IDs, IP addresses and hashed emails count |
| Processing | Anything you do with it: collect, store, read, send, delete |
| Controller | Decides why and how data is processed. Usually us, for our own users |
| Processor | Processes data on the controller's instructions. Our cloud host, email provider, AI provider |
| Data subject | The person the data is about |
| Supervisory authority | The national regulator, for example a country's data protection authority |
| Special category data | Racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic, biometric (for ID), health, sex life or sexual orientation (Art. 9) |
| Pseudonymised | Cannot be linked to a person without extra information kept separately. Still personal data |
| Anonymised | Cannot be linked to a person by anyone, by any reasonable means. No longer personal data |
What engineers must know
| Topic | What the law says | What it means for us | Article |
|---|---|---|---|
| Principles | Lawful, fair, transparent; purpose limitation; minimisation; accuracy; storage limitation; security; accountability | Collect the minimum, keep it no longer than needed, be able to prove it | 5 |
| Lawful bases | Six: consent, contract, legal obligation, vital interests, public task, legitimate interests | Record one basis per purpose in the RoPA. You cannot swap later | 6 |
| Consent | Freely given, specific, informed, unambiguous, by clear affirmative action. As easy to withdraw as to give. You must be able to prove it | No pre-ticked boxes, no bundling with the terms, an append-only consent ledger | 4(11), 7 |
| Children | Consent for online services: parental consent under 16; member states may lower it to 13 | Age gate; EU age table per country | 8 |
| Special category | Prohibited unless an Art. 9 condition applies | Free-text chat and profile fields about faith or health need explicit consent | 9 |
| Transparency | Tell people what, why, who, how long, their rights, at collection | Privacy policy plus in-context notices | 12-14 |
| Rights | Access, rectification, erasure, restriction, portability, objection, automated decisions | Build them in. See Data subject requests | 15-22 |
| Response deadline | Without undue delay, within one month; extendable by two further months with reasons | 30-day target, tracked per request | 12(3) |
| Privacy by design and default | Build protection in; default settings collect the minimum | Optional purposes default off | 25 |
| Processors | A written contract (DPA) with set terms; processors use sub-processors only with authorisation | Sign a DPA before sending data to any vendor | 28 |
| Records | Keep a record of processing activities (RoPA) | See Data map and RoPA | 30 |
| Security | Appropriate technical and organisational measures | Encryption, access control, logging, tests | 32 |
| Breach | Notify the authority within 72 hours unless unlikely to cause risk; tell people if high risk | See Breach response | 33, 34 |
| DPIA | Data protection impact assessment before high-risk processing | Profiling, large-scale special category data, systematic monitoring | 35 |
| DPO | Required for large-scale monitoring or large-scale special category data | Know who your DPO is | 37-39 |
| International transfers | Only with adequacy, appropriate safeguards (such as SCCs), or narrow derogations | Record a transfer basis for every flow that leaves the EEA | 44-49 |
| Fines | Up to EUR 20m or 4% of worldwide annual turnover, whichever is higher; EUR 10m or 2% for some duties | 83 |
Transfers outside the EEA
An adequacy decision says a country protects data well enough; transfers there need no extra paperwork. Otherwise use standard contractual clauses (SCCs) plus a transfer impact assessment. Telling users in the policy is transparency, not a lawful transfer.
- EU-US: the EU-US Data Privacy Framework adequacy decision (Implementing Decision (EU) 2023/1795, July 2023) applies to US companies certified under it. The EU General Court dismissed a challenge to it on 3 September 2025; an appeal to the Court of Justice (case C-703/25 P) was pending as of October 2026. Watch this: if it falls, US transfers need SCCs again.
- India had no EU adequacy decision as of October 2026, so EU to India transfers need SCCs.
Cookies and device storage
Reading or writing on a user's device (cookies, local storage, SDK identifiers) is governed by the ePrivacy Directive, Art. 5(3), as implemented in each country. Non-essential uses need prior consent. The Digital Omnibus proposal would move this rule into the GDPR; it is not law yet. See Staying current.
Guidance to read
- EDPB Guidelines 05/2020 on consent
- EDPB Guidelines 01/2022 on the right of access
- EDPB Guidelines 9/2022 on breach notification
- ICO guide to UK GDPR
Rules
Pick the lawful basis before you build, and write it in the RoPA. If you collect on consent and the user withdraws, you cannot switch to legitimate interests to keep going.
Treat hashed and pseudonymised data as personal data. Only truly anonymised data is out of scope, and a plain hash of an email is not anonymous.
Mistakes we made
- "Disclosing it in the policy" was offered as the fix for a transfer. Files of EU users would sit in a non-EU bucket. Disclosure satisfies transparency, not the transfer rules. The transfer still needed SCCs and an assessment.
- Special category data was not flagged. Users wrote about their faith and their health in free-text chat, and it was treated as ordinary data. Free text can hold anything; flag it as possible special category and gate it on explicit consent.
Checklist
- Lawful basis recorded per purpose.
- Art. 9 condition for any special category data.
- Notice covers what, why, who, how long, rights, transfers.
- DPIA done or ruled out with a reason.
- DPA with every processor.
- Transfer basis for every non-EEA flow.
- Rights work end to end within one month.
- Breach runbook tested.