GDPR

The GDPR is the European Union regulation governing personal data. It applies to any organisation processing the data of people in the EU, wherever the organisation itself is based, and it treats almost anything that can identify a person as personal data — including an email address, an IP address or a cookie identifier.

For a software project it turns into concrete requirements: a lawful basis for each use of data, consent that is genuinely optional for anything not strictly necessary, the ability to export or delete a person's data on request, retention that ends, and a record of who processes what on your behalf.

The parts most often missed in build projects are the unglamorous ones — analytics loaded before consent, a staging database full of real customer records, backups that outlive the deletion request. Designing for them costs little at the start and is expensive to retrofit under a complaint.