GDPR, or General Data Protection Regulation, means a lot to any business operating within/catering to clients in the European Union. In fact, more than €114 million of fines have already been handed out between May 2018 to January 2020. This only accounts for over 150,000 data breaches that occurred in leading countries within the European Union (EU). 

Even though Britain left the EU after 47 years, GDPR still applies. In a year or so, we can expect the UK to deploy similar regulations to protect our privacy. For now, GDPR remains in full effect. 

It’s important because the UK had the third-largest number of data breaches (22,181) following Netherlands (40,647), and Germany (37,636).

What is GDPR?

GDPR was introduced as part of the European Online Data privacy law to set a framework for the efficient handling and management of citizen data. This means that organisations who regularly collect, analyse, and store data of EU citizens must follow strict guidelines and maintain compliance or face hefty fines.

Here’s the breakdown of what GDPR demands:

• A right to data portability
• A right to be forgotten
• A right to know when personal data has been compromised
• Easy access to one’s own data

Whether you have a website or a mobile app (or both), if you have visitors or users from the EU, these rules apply. So what steps can we take to build a GDPR compliant app? Let’s take a look. 

How to build a GDPR compliant app

1. Determine if extensive personal data is needed

While this first point might sound silly, it’s essential to take a step back and ask yourself it the mobile app actually needs to collect a lot of personal data. The less personal data you have, the easier it will be to maintain compliance.

You’ll have to conduct an audit to ascertain exactly how you ensure data security at the moment, and how you can improve present protocols to maintain compliance.

Ideally, you wouldn’t want to collect details such as names, birth dates, nationalities, and more. But this is not always possible. 

During the ideation stage, map out how much user data you’ll need to deliver enhanced user experiences (and achieve your business goals). As a rule, only collect data that’s critical to your business model.

2. Design the app with privacy in mind

Under GDPR, it’s a legal requirement to implement “privacy by design.” What does that mean? It means that your app can only store and process data that’s deemed necessary under Article 23. 

The only way to achieve this is by making privacy a priority from discussion to deployment. Even if a third-party services provider is developing your mobile app, data protection and user privacy must form the foundation of the build.

If you outsource your app development to countries outside of the EU, make sure you only partner with an offshore or nearshore provider that has a legal office/HQ either within the EU or in the United Kingdom. Also, make sure all of your or your clients’ sensitive data is stored and processed within the EU/UK.

For instance, at Evolve, we keep DevOps, cybersecurity experts, and clients’ data in the UK, while keeping software development, QA and non-business- critical functions in our Ukraine-based R&D Centre.

3. Get explicit consent from users

For a mobile app to be GDPR-compliant, all companies must ask and obtain explicit consent from users (to collect, analyse, and store their data). This also includes any data collected by your partners for advertising, crash logging, and more.

Users must be presented with a simple “opt-out” option when they sign up to use the app. This can be displayed immediately after the app is downloaded and launched for the first time. Furthermore, your users should also have the option of withdrawing consent at will (so make it easy). 

If your app requires user data to work, then explain it to them. Since your users took the time to find your app and download it, there’s a good chance that they’ll accept it.

4. Encrypt anything and everything

Whether it’s a web app or a mobile app, encryption is key to protecting customer data. You can even refer to it as an enterprise saviour. 

As no plan is foolproof, companies need to take appropriate measures to deal with data breaches. If we take genealogical services provider, MyHeritage, for example, more than 92 million users were affected by a data breach last year. 

In this scenario, while the email addresses were visible, the passwords were encrypted. As a result, there was no evidence that bad actors used this data. The company’s encryption methods, the prompt investigation into the matter, and full disclosure helped ease the blow of this security incident.

It’s also a good idea to inform your users that you’re taking all the necessary steps to secure sensitive data. This could help them make the final decision to signup and use your application. 

5. Automate the deletion of user data 

Whenever users cancel their membership, automate the process of deleting the data of former users. Remember, they have the “right to be forgotten,” and companies must respect that.

This should be explicitly clear to users. By embracing transparency and making it all clear, you have a better chance of maintaining compliance. By automating this function, you can ensure that former users to don’t fall between the cracks. 

6. Engage in penetration testing

Before your application is published, it’ll be critical to engage in extensive penetration testing. Let’s face it, things can be missed by the best of us, so it’s always a good idea to participate in pen-testing.

If you have the resources, hire a third-party security testing provider to support both in-house and extended security teams.

These testing cycles should continue throughout the lifetime of the app.

In January 2019, Evolve sent several developers working on client-tailored extended teams to a cybersecurity workshop commissioned by our partner Arcturus in Ukraine. As a result, we were able to embed penetration testing in our SDLC and offer it to all clients to ensure better security of their software products being built in our Kyiv-based R&D Centre.

Finally, here are some non-technical steps you also have to take to ensure GDPR compliance:

• Appoint a data protection officer
• Formulate clear and easy to read privacy policies 
• Have a data breach plan ready
• Have data breach notification prepared
• Make it easy for users to be forgotten

Although GDPR and similar regulation around the world might seem like a massive headache, it’s not. Despite all the strict rules, it adds value to digital products. 

When users know that you have gone the extra mile to secure their sensitive information and see that you’re committed to data security, you’re on your way to building trust and brand loyalty.

Are you looking for a professional team of mobile app developers, compliance managers, and cybersecurity experts? Request a call from Evolve and find out how we can help you achieve your business goals without breaching any data protection regulations.