4 steps developing GDPR-compliant apps
Tags: app, compiant, gpdr, dsgvo
Published: 2020-11-10 09:28:40

<p><span style="font-weight: 400;">Technological growth has come with an unprecedented increase in the amount of personal data collected by various online platforms. For the sake of user privacy, the dedicated law was introduced to improve the means of data protection used by businesses in the European Union.</span></p>
<p><span style="font-weight: 400;">Since virtually any mobile application can gather data about user actions, authorities call on companies and various different companies to provide information and disseminate about </span><a href="https://cipherpoint.com/de/blog/dsgvo-einhalting-anforderungen"><span style="font-weight: 400;">DSGVO</span></a><span style="font-weight: 400;"> to ensure the safety of users by minimizing the amount of data collected. To do this, companies are advised to conduct an audit before starting product development. This is necessary to assess the risks that the user is exposed to when the app collects and processes their personal data.</span></p>
<h2><span style="font-weight: 400;">Mobile apps &amp; Personal data protection</span></h2>
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/s86ug1v9aczdwh4xq255.png)
<p><span style="font-weight: 400;">The main GDPR message centers around minimizing the amount of personal data that applications collect from users' phones. Mobile apps should process only the information necessary for their functioning.</span></p>
<p><span style="font-weight: 400;">The law applies not only to EU-based companies but also to all those businesses that, theoretically, can interact with the EU residents and gather their data. Thus, compliance is mandatory for every company that brings its applications to the European market.&nbsp;</span></p>
<p><span style="font-weight: 400;">There are a few steps you should take to develop a GDPR-friendly mobile app.&nbsp;</span></p>
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/8zfqhqe0jjjojtamndki.png)
<p><span style="font-weight: 400;">Dura lex, sed lex: The law is harsh, but it is the law</span></p>
<p><span style="font-weight: 400;">First things first &mdash; you need to know the law and understand what you will have to comply with. The full text of the GDPR law is available on&nbsp;</span><a href="https://gdpr-info.eu/"><span style="font-weight: 400;">the official website</span></a><span style="font-weight: 400;">, where you can find a convenient guide and a search engine in order to find something specific.</span></p>
<h3><span style="font-weight: 400;">Get user approval</span></h3>
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/av70zh1cb682gwtpm6rv.png)
<p><span style="font-weight: 400;">According to the law, all companies that intend to interact with EU-based customers are required to warn them about personal data collection and ask them to agree to it. As you can imagine, this data may come from anywhere &mdash; analytics, promotions, and logs. However, you can no longer use the standard approach with the terms and conditions page. You may have such a page, but before gathering any data, you still have to ask the user about it. The question should be simple and clear, with no confusing terms.</span></p>
<p><span style="font-weight: 400;">This can be implemented as a pop-up window before the application launch. Probably, this could scare off a certain percentage of users. But most of them will still proceed with the app.&nbsp;</span></p>
<p><span style="font-weight: 400;">In addition, you must also provide users with the ability to delete their data, and this process should be as simple as possible.&nbsp;</span></p>
<h3><span style="font-weight: 400;">So, what should you include in your mobile app?</span></h3>
<ul>
<li style="font-weight: 400;"><span style="font-weight: 400;">A message during each app start, warning users about the collection of their data;</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">A notification that the data collection process has begun, explaining what this information will be used for;</span></li>
<li style="font-weight: 400;"><span style="font-weight: 400;">An option for the user to delete their data if they wish so.</span></li>
</ul>
<h2><span style="font-weight: 400;">Outline clear Privacy Policy</span></h2>
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/tk1svszfx3x49cy5vjlx.png)
<p><span style="font-weight: 400;">According to the GDPR law, users must have an idea of how their data is gathered and stored. This understanding is achieved through a clear and structured&nbsp;</span><a href="https://www.privacypolicies.com/blog/how-write-privacy-policy/"><span style="font-weight: 400;">Privacy Policy</span></a><span style="font-weight: 400;">.</span></p>
<p><span style="font-weight: 400;">This should not be news to mobile developers, as this is also a requirement from the App Store and Google Play. Applications that do not have a separate page of their Privacy Policy and the corresponding section are deleted.</span></p>
<p><span style="font-weight: 400;">Besides, if your application interacts with any third-party services (analytics, advertising, etc.), this should also be reported to users in the Privacy Policy section. The developer's task is to make sure that all third-party services, which have access to the app&rsquo;s user data, are also GDPR-compliant. In order to acknowledge this, it is necessary to conclude data processing agreements with all parties involved.</span></p>
<h2><span style="font-weight: 400;">Review all places where data can be stored</span></h2>
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/ja130irvnpo9uw3iodym.png)
<p><span style="font-weight: 400;">User data spreads like a virus to various places. For your application to meet data protection parameters, you need to index all user data and understand where it can be stored. These are not only databases, but also servers for social networks, third-party services, advertising agencies, and so on. You will be surprised to learn how much user data is deposited on the side.</span></p>
<p><span style="font-weight: 400;">To facilitate the process, work out a data roadmap. It will give an understanding of which channels the data comes from, by whom it is processed, and where it will settle. Moreover, this is necessary to provide a quick response to any leaks, as well as to assure users that their data has been deleted everywhere (if they require so).</span></p>
<h2><span style="font-weight: 400;">In conclusion</span></h2>
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/p1rn1woctnxc5hy81i20.png)
<p><span style="font-weight: 400;">Let's summarize what you need to remember if you want your mobile application to meet data protection standards and to operate in the European Union.</span></p>
<p><span style="font-weight: 400;">All companies dealing with the EU residents' data must follow the rules above. We again strongly recommend you to read the full text of the law following the link at the beginning of the article, as well as&nbsp;</span><a href="https://techblog.bozho.net/gdpr-practical-guide-developers/"><span style="font-weight: 400;">this</span></a><span style="font-weight: 400;">&nbsp;more tech-oriented guide. The requirements also apply to companies that provide third parties with access to such data.</span></p>
<p><span style="font-weight: 400;">If these rules are not met, the application developer will suffer serious issues in the form of fines and loss of user confidence. While the fact of compliance means that your company values user privacy and makes every effort to protect personal data.&nbsp;</span></p>