GDPR for an app: the 5 points to check

Does your app comply with the GDPR? There is no honest yes or no without looking at what it actually does. Here are five concrete checkpoints to help you go through it.

One clear note: this article is not legal advice. It helps you ask the right questions of your team, and for the tricky cases, a lawyer or a data protection officer is the right person to ask.

The GDPR in one sentence

The GDPR is the European regulation governing the use of personal data: any information that can identify someone, such as a name, an email, an address, an account ID, and sometimes an IP address.

Think of a doctor's office. Patients entrust it with information. In return, it must know what it keeps and why, who can open the files, and hand a file back to a patient who asks. Your app plays the same role toward its users.

The 5 points to check

1. The data you collect

List, field by field, what your app stores: sign-up form, profile, payments, technical logs, analytics tools. For each piece of data, ask one question: do we really need it?

What you do not collect, you do not have to protect or justify. Collecting less is the most effective move.

2. The legal basis, in plain terms

Every use of data must rest on a recognised reason. The most common ones in practice:

• delivering a service: you need the shipping address to ship;
• a legal obligation: keeping invoices, for example;
• legitimate interest: a real business need that must not override the person's rights;
• consent: the person said yes, freely and clearly.

Consent is not the answer to everything. For many uses, another basis fits better. What matters is knowing which one applies to each piece of data.

3. Notices and consent

Users must know what you do with their data before they hand it over. Check that:

• a clear, up-to-date privacy policy exists;
• the information is given at the moment of collection, not hidden three clicks away;
• where consent is needed (some trackers, some marketing emails), the box is not pre-ticked and refusing is as easy as accepting;
• you keep a record of what each person agreed to.

4. People's rights

Your users can ask to see their data, correct it, delete it, or take it with them. Ask three practical questions:

• Could we find all of a person's data, including in backups, third-party tools and exported files?
• Could we really delete it, and not merely hide the account?
• Who receives the request, and who answers it on time?

If the answer to any of these is "we do not know", that is a point to work on.

5. Security and subcontractors

Protecting data is part of the obligation. Look at:

• who has access to what: does an intern need to see every account?
• encryption of connections, and how passwords are stored (see password hashing);
• backups and how they are protected (see backup and replication);
• your subcontractors: hosting, emailing tool, analytics, payments. For each one, do you know what data it receives and where it is processed, and is there a contract covering that use?

The last point is often forgotten: a provider that processes data for you also involves your responsibility.

Where to start

One sheet is enough. One column per point, one row per piece of data, and an owner named for every empty cell. Many apps have gaps simply because nobody took the time to lay everything out.

Key takeaway

The GDPR is prepared by answering five questions: which data, for what reason, with what information, with what rights, and protected how. This article is not legal advice: for the cases that matter, get help from a specialist.

And for your product?

Some of these points can be checked in the code: who can read which data, what is stored, what flows to third-party services. That is an angle an audit of your app can cover, alongside a lawyer's opinion. If you would like to talk it over, we can set aside 30 minutes to see what deserves a look first.