Security & Data Protection
Which data occurs, where it lives and who may see it — decided before the first line of code.
- GDPR
- Processing agreement
- Roles
How it works
This is not a legal text but a stocktake. We are not a law firm, and we will tell you where that line runs.
Which data actually occurs
We go through the requirements and write down which personal data they produce. Regularly it is more than expected: access logs, crash reports, push identifiers, uploaded files.
Who may see what
The roles from requirements engineering become a permissions concept. Who may read, change, export. Export is the interesting case: it tends to be forgotten, and it is the most convenient way to obtain everything at once.
Where the data lives
Server location, encryption in transit and at rest, backups and how long those are kept. If you have customers in regulated industries, you will be asked — better to have the answer in writing.
Deletion
A period and a procedure for every kind of data. This is the part almost every project omits, and the only one that is nearly impossible to retrofit.
- Your data protection officer, or whoever fills that role.
- Requirements from your industry: retention periods, server location, certifications you have to maintain.
- The list of services you already use — every one of them is a recipient.
A data concept with roles, retention periods and storage locations, plus the template for the processing agreement.
If you skip this
Personal data accumulates on its own. Sorting it out at the audit means sorting it out in a running application — and retrofitting retention periods means deleting data that features have since come to depend on.
Questions about this step?
A conversation costs nothing and takes half an hour. Afterwards you will know whether we are a fit.