Contents
A business app that processes personal data must appear in the record of processing activities, collect only what is needed, apply retention periods, let people exercise their rights, be secured and have its processors under contract. Most of these obligations become features to plan for in the requirements.
The GDPR does not tell you how to code an application, but it sets obligations that become very concrete as soon as a business tool stores customers, contacts or employees. The good news: almost all of them translate into specific features that are easy to plan in the requirements and expensive to add later. Here is the list, with the relevant articles and what the app has to do. This page is a practical guide, not a substitute for advice from a lawyer or your DPO.
The obligations and how they translate into features
The reference text is Regulation (EU) 2016/679, supplemented by guidance from the CNIL, the French data protection authority (sources checked October 27, 2026).
| Obligation | GDPR article | What the app needs to support |
|---|---|---|
| Data protection by design | Article 25 | Collect only useful fields, most protective settings by default |
| Retention periods | Article 5 | Automatic archiving, then deletion or anonymization, based on defined rules |
| Information and data subject rights | Articles 13 to 21 | Export, correction, erasure and objection, handled from the back office |
| Record of processing | Article 30 | A description of the tool: purposes, data categories, recipients, retention, security measures |
| Security of processing | Article 32 | Strong authentication, role-based access, encryption, backups, logging |
| Processors | Article 28 | Contracts with the host, third-party services and the maintenance provider |
| Data breaches | Articles 33 and 34 | Logs showing what was exposed, a notification procedure |
| Impact assessment | Article 35 | A DPIA if the processing poses a high risk |
| Transfers outside the EU | Chapter V | Hosting and third-party services in the EU, or a lawful transfer mechanism |
Collect less, keep it for less time
Data minimization is the easiest principle to apply and the one most often forgotten. Every form field has to meet a real need. A sales contact’s date of birth, an employee’s social security number in a scheduling tool: if the use is not justified, the field does not exist.
Retention periods are decided with you during scoping, based on legal requirements and regulator guidance. Technically, I turn them into automated jobs: a prospect with no contact for the agreed period is archived, then deleted or anonymized. A rule written in a procedure but never applied by the tool protects nobody.
Let people exercise their rights
Anyone can ask to access their data, correct it, erase it or object to certain processing. The company has to respond within one month, extendable in some cases (Article 12). Without the right tool, answering an access request means digging through several spreadsheets and inboxes.
In a well-designed app, the back office lets you, in a few clicks:
- export all of a person’s data in a readable format;
- correct or delete a record, while handling linked data (invoices that must be kept, history to anonymize);
- log the request and the response given.
Security, processors and breaches
Article 32 requires measures “appropriate” to the risk. The CNIL details them in its practice guide for the security of personal data, 2024 edition (published March 26, 2024). For a business tool, that means at a minimum: named accounts and role-based access, strong passwords or two-factor authentication, encrypted connections, tested backups and an audit trail of changes.
Every provider that accesses the data (host, email service, e-signature tool, AI provider, maintenance provider) must be bound by a processor agreement. Where they are located matters: see hosting your data in France or the EU.
If a breach poses a risk to individuals, the supervisory authority must be notified without undue delay and, where feasible, within 72 hours (Article 33). The people affected must be informed if the risk is high (Article 34). Every breach, even one that is not reported, must be documented internally. The app’s logs are what let you establish what happened.
Records and impact assessments
The record of processing activities applies to all organizations. The exemption for organizations with fewer than 250 employees is narrow: customer, supplier and payroll management must be recorded. On delivery, I provide a technical description of the tool (data, flows, hosting, security measures) that makes it easier for your DPO to update the record.
A data protection impact assessment (DPIA) is required when the processing poses a high risk. The CNIL has published a list of processing types for which it is mandatory (in French). A tool that monitors employee activity, profiles people or processes health data at scale calls for careful review.
When custom software adds nothing for GDPR
I will be straightforward: a serious off-the-shelf product, hosted in the EU, with a clear processor agreement, can be fully compliant. Custom software is not more “GDPR-friendly” by nature. What it brings is control: you choose the hosting, the fields collected, the purge rules and who has access to the code. If your need is standard and the vendor checks those boxes, compliance alone does not justify custom development.
How I build it into a project
- During scoping: list of data, purposes, retention periods, roles and permissions, processors, questions for your DPO.
- In the mockups: export, correction and deletion screens, consent where needed.
- During development: permissions enforced on the server, automatic purges, logging, encryption.
- On delivery: a technical description for the record, third-party service contracts to sign in your name.
These elements are part of every business app I build. For a budget range, the estimator includes the “accounts and roles” component.
Frequently asked questions
Who is the controller: the company or the developer?
The company that uses the app and decides what it is for is the controller. A provider that hosts or maintains the tool and accesses the data generally acts as a processor, which requires a contract that meets Article 28 of the GDPR. A developer who delivers code without accessing real data is not always a processor: have your lawyer assess the situation.
Does a company with fewer than 250 employees need a record of processing?
Yes, in most cases. The French data protection authority, the CNIL, points out that the exemption only covers occasional, low-risk processing. Managing customers, suppliers or employees, which is exactly what a business tool does, must be recorded.
Do we need a DPO to deploy a business app?
Appointing a data protection officer is mandatory in specific cases (public bodies, regular and systematic monitoring at scale, sensitive data at scale). For other companies, it remains recommended. Check your situation with your data protection authority.
How much does it cost to make an app GDPR-compliant?
If it is planned from scoping, it is part of the project: access rights ($1,700 (€1,500)excl. VAT in my rate card for accounts and roles), automatic purging, exporting a person’s data, logging. Adding it afterwards costs much more, because the data structure has to be reworked.