The GDPR (General Data Protection Regulation) is a regulation in EU law on data protection and privacy for all individuals within the European Union (EU) and the European Economic Area (EEA).
The GDPR aims to unify the EU’s common data protection practices to simplify the regulatory environment for international business and give control to individuals over their personal data.
The regulation replaced the EU’s 1995 Data Protection Directive 95/46/EC, which regulated the processing of personal data and the free movement of such data within the European Union. The GDPR became enforceable on May 25, 2018, and it doesn’t require local governments to pass any enabling legislation.
In short, the GDPR requires companies to safeguard their users’ data and protect their privacy rights.
Companies that deal with personal data of European users are required to build their Systems and processes with data protection mechanisms by default. This means pseudonymisation or full anonymisation, encryption and use the highest-possible privacy settings by default, so that the data is not available publicly without explicit, informed consent, and cannot be used to identify a subject without additional information stored separately. The GDPR additionally gives EU citizens the right to request a portable copy of their data, the right to have their data erased, and the right to revoke their consent.
Any company, regardless of its geographical location, that processes data of to EU citizens and fails to comply with the GDPR can receive a fine of up to €20 million or up to 4 percent of its annual worldwide turnover of the preceding financial year.
When a company decides to outsource some of its functions, it still remains responsible for the personal data transferred to the outsourcing vendor. The only way for a company to avoid GDPR liability is to ensure that it cannot access any personally identifiable data under any circumstances, which is often impossible in practice.
GDPR-compliant Software Development
Irrespective of whether a company use their own staff to develop software or hire a software development company or purchase an off-the-shelf software solution*, there are some essential secure software development practices they need to know about.
Since GDPR became enforceable less than a year ago, not many people know what it entails and how it relates to Software Development. Just because you have partnered up with IT outsourcing company which has European clients doesn’t mean the company understands the impact of the GDPR and is able to develop GDPR-compliant software solutions.
The GDPR places a huge emphasis on documentation and transparency. Companies must be able to clearly describe what data they are collecting, for what purpose, for how long, and who can access them, among other things.
Although the GDPR doesn’t require companies that collect data from EU citizens to provide their users with online automated access for data management, it will be in the company’s best interest to do so. Without automated data management capabilities, each data-related request would have to be followed by a lengthy identity verification process to prevent data breaches.
In conclusion, the GDPR is meant to alter software development practices and force software development companies to take steps toward better application design and greater security.
This may lead to some software development companies leaving the market due to their inability to adapt, but that would reduce the number of data breaches and force companies to disclose them sooner, thus protecting the interest of end users.
It has also created a tremendous opportunity for software development companies to differentiate themselves by implementing secure software development practices such as those mentioned above.
Content taken from:
https://brainhub.eu/blog/gdpr-secure-software-development-practices/