GDPR and Data Privacy: What Product Teams Must Build
Key takeaway
Privacy compliance becomes engineering work in four places: a consent mechanism that actually gates tracking, the ability to export and delete a person's data on request, enforced retention periods, and an accurate record of what you store and where. Build those four and most of the rest is documentation.
GDPR, and the similar regimes that followed it, are usually handled as legal documents and then land on an engineering team as a surprise. Most of the regulation is process — but four parts are software, and retrofitting them is considerably more expensive than designing them in.
1. Know what you hold
Maintain a data inventory: every personal data field, why you collect it, its lawful basis, where it's stored, who can access it, and how long you keep it. This is the artifact every other requirement depends on, and the one most organisations discover they don't have on the day a request arrives.
2. Consent that actually controls something
- Tracking and marketing scripts must not load before consent — a banner that shows while analytics already runs is worse than no banner, because it documents the violation.
- Consent must be as easy to withdraw as to give, and it must be recorded with a timestamp and version.
- Granular by purpose: analytics, marketing, and functional are separate decisions.
- Pre-ticked boxes and "by continuing you agree" do not constitute consent.
3. Data subject rights as real features
- Access and portability — produce everything you hold on a person in a machine-readable format, typically within a month.
- Erasure — delete across primary storage, backups policy, logs, analytics, and any third party you shared it with. This is the requirement that exposes undocumented data copies.
- Rectification — let support correct data without a database console.
- Objection and restriction — the ability to suppress processing without deleting the record.
4. Retention and minimisation, enforced by code
A retention policy nobody implements is a liability, because it documents an obligation you're demonstrably not meeting. Put deletion jobs in the system, keep only fields you have a stated use for, and pseudonymise analytics data that doesn't need to be identifiable.
The operational pieces
- Data processing agreements with every sub-processor, and a current list of who they are.
- A breach process that can notify within 72 hours — which requires detection first.
- Privacy by design in the definition of done: new features declare what personal data they introduce.
- Transfer mechanisms for data leaving the region, documented rather than assumed.