GDPR for Technology Teams

The General Data Protection Regulation, or GDPR, governs the processing of personal data. For a technology team, it turns privacy into system requirements.

Personal data is any information relating to an identified or identifiable person. A name or email address is an obvious example. An online identifier, location record, or combination of attributes can also identify someone.

Processing means almost anything a system does with personal data. Collection, storage, retrieval, use, disclosure, alteration, and deletion all count.

This course gives you a technical mental model. It does not replace advice from your data protection officer or legal team. Your job is to make approved purposes, retention rules, individual rights, and risk controls work in real systems.

Start with purpose, not data

Every processing activity needs a specific purpose and a valid legal basis. Consent is one possible legal basis, not a universal default. Other bases include performing a contract, meeting a legal obligation, protecting vital interests, carrying out a public task, and pursuing legitimate interests under the conditions in the regulation.

A technology team should receive the approved purpose and legal basis from the accountable business, privacy, or legal role. Engineers should not invent either one from a database schema.

Purpose limitation constrains later use. Data collected for one stated purpose does not become a free input for every future feature. A proposed new use needs review for compatibility and legal basis.

Data minimization asks you to collect and process only what the purpose needs. Storage limitation asks you to keep it no longer than needed. These are architecture constraints, not wording for a privacy notice.

Model the processing

You cannot apply these constraints to an unknown data flow. Build a processing inventory that connects:

the purpose and legal basis;
categories of people and personal data;
collection points and sources;
services, databases, logs, caches, backups, and analytics systems;
recipients, processors, and international transfers;
retention and deletion behavior;
access, correction, export, restriction, objection, and erasure paths;
security controls and evidence.

GDPR for Technology Teams

Start with purpose, not data

Model the processing

Relevant careers