GDPR

GDPR applies to any organisation that processes the personal data of people located in the EU, regardless of where the organisation itself is established. This extraterritorial scope means a non-EU software vendor serving EU users must still comply.

The regulation distinguishes two roles: the data controller, who determines the purposes and means of processing, and the data processor, who processes data on the controller's behalf (typically a SaaS provider or hosting partner). Both carry direct obligations.

Key obligations for organisations include:

• Lawful basis: every processing activity needs a legal basis (consent, contract, legal obligation, vital interests, public task, or legitimate interest).
• Transparency: clear privacy information must be provided to data subjects.
• Records of processing: maintaining a register of processing activities.
• Data Protection Impact Assessments (DPIA): required for high-risk processing.
• Breach notification: notifying the supervisory authority within 72 hours of becoming aware of a breach, where feasible.
• Data Protection Officer (DPO): mandatory for certain public bodies and organisations engaged in large-scale or sensitive processing.

GDPR also grants individuals enforceable rights: access, rectification, erasure (the "right to be forgotten"), restriction, data portability, and the right to object.

GDPR enforcement is structured around two tiers of administrative fines, applied by national supervisory authorities (such as the CNIL in France).

For software teams, GDPR is not a one-off legal checkbox but a set of engineering constraints. Two principles are written directly into the regulation:

• Data protection by design: privacy safeguards must be built into systems from the outset, not bolted on later.
• Data protection by default: the most privacy-protective settings should apply unless the user actively changes them.

In practice this shapes how custom software, CRM, and ERP platforms are architected: data minimisation in the schema, granular access controls, audit logging, encryption of personal data, configurable retention and deletion policies, consent management, and the technical ability to export or erase a user's data on request. Cross-border transfers of personal data outside the EU also require an appropriate safeguard, such as Standard Contractual Clauses or an adequacy decision.