Data Privacy by Design: GDPR and Privacy Engineering for Software Teams

GDPR fines have exceeded €4 billion since the regulation came into force. CCPA, PIPL, and dozens of national privacy laws have followed. Privacy compliance has become a global engineering requirement, not a regional legal nicety.

Privacy by Design Principles

Privacy by Design is an engineering philosophy, not a compliance checklist:

1. 1Proactive, not reactive: Address privacy risks before they materialise
2. 2Default to privacy: Systems should collect minimum data and restrict access by default
3. 3Privacy embedded into design: Privacy is a first-class architectural requirement
4. 4Full functionality: Privacy should not come at the expense of functionality
5. 5End-to-end security: Data is protected throughout its lifecycle
6. 6Transparency: Users know what data is collected and how it is used
7. 7Respect user privacy: User-centric design and control

Technical Implementation

Data minimisation: Collect only the data you actually need. Audit every field in every form and database table—if you cannot articulate why you need it, don't collect it.

Purpose limitation: Define the purpose for each data point before collection. Implement technical controls that prevent repurposing.

Consent management: Implement granular, revocable consent with a complete audit trail. Use a Consent Management Platform (CMP) for cookie consent.

Right to erasure: Build deletion workflows from day one. Cascading deletes across all systems, including backups and caches, are complex—design for them upfront.

Data portability: Implement export functionality in standard formats (JSON, CSV) for all user data.

Encryption: Encrypt personal data at rest and in transit. Implement field-level encryption for highly sensitive data (health, financial).

The Data Inventory

You cannot protect data you don't know you have. Maintain a living data inventory mapping every personal data element to its: collection source, storage location, retention period, processing purpose, and sharing destinations.