Don't Panic — GDPR for Technology Teams

The GDPR is the part where privacy stops being a policy-shaped cloud and starts making demands of systems. It governs processing of personal data, and processing is an impressively broad word: collecting, storing, using, sharing, changing, and deleting can all qualify. A name is not required for the data to matter; an online identifier or a revealing combination of attributes can be enough.

The useful mental model is purpose first. Before asking where a field goes, establish why the processing exists and the approved legal basis for it. That purpose is a boundary, not a decorative label for a database table. A dataset that was useful for one feature does not quietly become available to every future feature, no matter how eagerly the dashboard waves at it.

Then make a data flow map. Follow personal data from collection through services, stores, queues, logs, analytics, exports, support tools, and backups. The primary database is only one stop on this journey. The surprise is that privacy work becomes hardest where systems have been most successful at copying data around. A deletion that clears one account row is not much help if an index, warehouse, or restore process promptly remembers it again.

Roles matter because they decide who is accountable for which actions. A controller decides why and how processing happens; a processor acts on the controller's behalf. The label on a contract does not settle this. Neither does outsourcing storage: the controller still owns the decisions about purpose, retention, and risk.

The seven principles provide the repeated questions. Is the use tied to its purpose? Does every field need to exist? Can a correction reach derived copies? Does retention actually end? Can the organization show evidence? Privacy by design puts those questions into architecture. Privacy by default makes the initial settings collect less, share less, and expose less. This is less glamorous than a magic compliance badge, but it has the advantage of working.

When something goes wrong, a personal data breach can affect confidentiality, integrity, or availability. Escalate early, map the affected systems and people, and preserve the timeline and evidence. A data protection impact assessment belongs before high-risk processing, not beside the launch cake crumbs.

Read the intro for the full system model and its limits. Use the slides to keep the purpose-to-evidence path in view. The cheatsheet is the operational reference for rights, retention, breaches, DPIAs, vendors, and transfers. Field Notes covers the awkward places where an apparently complete control usually turns out to be only the first stop.

Don't Panic — GDPR for Technology Teams

Relevant careers