GDPR and custom software: what an SME should know before starting

Written by Davide Ferraretto

Many companies that come to me for custom software haven't yet clarified which data they will process and under which privacy constraints. I'm not a lawyer and this doesn't replace dedicated legal advice, but in technical design I've long applied some privacy-by-design principles that are worth knowing before starting a project.

Understanding which personal data is involved

The first step, often underestimated, is mapping which personal data (of customers, employees, suppliers) the new system will actually process, and for what purpose. This analysis should happen before technical design: it determines, for example, whether a consent system is needed, how long data should be retained, and who can access it.

Privacy by design in practice

At a technical level, this means collecting only the data that's actually necessary, encrypting sensitive information both at rest and in transit, applying granular role-based access controls, and planning from the start for features such as exporting or deleting a user's data, instead of bolting them on right before an audit.

Documentation and shared responsibility

GDPR compliance doesn't end with the code: it's useful for the technical provider and the client company to agree, starting from the quote, on who maintains the records of processing activities, who handles any data breaches, and how subprocessors (hosting, email delivery, third-party services) involved in the system are managed.

Addressing these topics during the analysis phase, before even sketching the first mockup, avoids delays and rework costs close to launch. For an SME, it means reaching launch with a solid foundation to build trust with its own customers.