Privacy by Design: Why Integrate GDPR Compliance From the Start of a Project?
DPO Consulting Joins Grant Thornton
Deploying an application, migrating to the cloud or integrating artificial intelligence may involve new personal data processing activities. Assessing GDPR requirements only after the technical choices have been finalized can lead to delays and costly remediation.
Article 25 GDPR requires controllers to implement data protection by design (Privacy by Design) and data protection by default (Privacy by Default). The challenge is to translate these obligations into operational decisions rather than treating compliance as a final validation step.
Organizations looking to structure this approach across their projects can also integrate GDPR compliance support into their technical and business processes.
Technical and organizational measures must be considered when determining the means of processing and maintained throughout the processing lifecycle. They should take into account the state of the art, implementation costs, the context of the processing and the risks to individuals.
By default, only personal data necessary for each specific purpose should be processed, with limited retention and accessibility. In practice, this can mean avoiding mandatory fields where they are unnecessary, restricting access rights and disabling intrusive features when they are not required.
Anticipating these requirements makes it possible to adapt the architecture, contracts and user journeys before changes become difficult or expensive to implement.
Where a Data Protection Officer (DPO) has been appointed, they must be involved properly and in a timely manner in issues relating to personal data protection, in accordance with Article 38 GDPR. Involving the DPO only shortly before launch leaves little room to correct structural decisions.
Good practice: involve the DPO from the project scoping stage and establish compliance checkpoints at key stages of the project.
For organizations without sufficient internal resources, an outsourced DPO service can help integrate data protection expertise throughout the project lifecycle.
A compliance document or an up-to-date record of processing activities is not enough. GDPR requirements must actually operate within the solution: restricted access, accessible privacy information, mechanisms for exercising data subject rights, deletion processes and security measures appropriate to the risks.
Good practice: translate GDPR requirements into concrete controls accompanied by validation criteria and verifiable evidence.
This is consistent with the approach recommended by the CNIL for integrating data protection requirements into application and website development.
A Data Protection Impact Assessment (DPIA) must be carried out before processing where that processing is likely to result in a high risk to the rights and freedoms of individuals, pursuant to Article 35 GDPR. This can notably include certain large-scale processing operations involving special categories of personal data.
Starting the assessment at the end of the project may require changes to the architecture. Whether a DPIA is required should therefore be assessed based on the relevant criteria and the applicable CNIL lists, without assuming that every innovative project automatically requires a DPIA.
Good practice: document the assessment during the scoping phase, conduct the DPIA before processing where required and review it if the risks change.
Organizations may also seek support in conducting DPIAs so that risks and mitigating measures can be identified early enough to be incorporated into the project design.
Compliance should involve business teams, IT, information security, procurement, legal teams and the DPO according to their respective responsibilities. The data controller remains accountable for compliance with the GDPR.
A structured approach can be organized around four steps:
Scope the project: define the purposes, legal basis, necessary data, data flows, recipients and roles; check the requirements applicable to special categories of personal data.
Define the requirements: establish privacy information, data subject rights, retention periods, security measures and privacy-friendly default settings; manage processors in accordance with Article 28 and any transfers outside the European Economic Area.
Test the measures: during acceptance testing, verify access rights, deletion processes, privacy information journeys and responses to data subject requests; retain evidence of these controls.
Decide and monitor: address gaps before launch, assign remedial actions and reassess compliance when the processing activity changes.
An application may, for example, be unable to delete data when the applicable retention period expires. Correcting this late in the project may require additional development and testing. However, a lack of automation is not in itself necessarily non-compliant if a reliable alternative mechanism effectively ensures compliance with the applicable retention periods.
Before launch, the relevant measures should be operational and identified gaps assessed. Internal acceptance of a risk cannot make unlawful processing lawful: issues preventing compliance with applicable obligations must be addressed before processing begins.
The DPO provides advice and monitors compliance with the GDPR; the DPO does not bear responsibility for the organization’s overall compliance and is not responsible for authorizing a production launch. That decision lies with the authorized decision-makers under the responsibility of the data controller, taking the DPO’s recommendations into account.
Where a DPIA indicates that processing would result in a high residual risk despite the measures envisaged to mitigate it, the controller must consult the CNIL, or other competent supervisory authority, before commencing the processing in accordance with Article 36 GDPR. Merely escalating the matter internally to decision-makers is therefore insufficient.
Integrating data protection by design and by default can reduce costly remediation and provide practical protection for individuals. This approach requires testable requirements, clearly defined responsibilities and ongoing monitoring throughout the lifecycle of the processing activity.
Key takeaway: compliance should guide project decisions. It should not be reduced to a documentation exercise or DPO sign-off.
Looking to integrate Privacy by Design into your projects, conduct a DPIA or identify GDPR compliance gaps before going live? DPO Consulting’s experts can help embed data protection requirements throughout the project lifecycle: https://www.dpo-consulting.com/contact-us
.svg)
