GDPR Is Making Changes In Tech Data Strategy, Are you ready?
Tags: gdpr, data, security, workflow
Published: 2018-04-26 00:01:13

---
title: GDPR Is Making Changes In Tech Data Strategy, Are you ready?
published: true
description: May 18 marks the target for GDPR compliance in the EU here are some key points that a U.S. Developer should look at
tags: GDPR, data, security, workflow
---
# May 25 marks the target for GDPR compliance in the EU here are some key points that a US Developer should look at
## The Changing Privacy Landscape *The revamp will modify the Data Protection Directive of 1995*
## First is the General Data Protection Regulation or **GDPR** 
All of the existing principles from the original Directive stay with us under GDPR. What GDPR adds is new definitions and requirements to reflect changes in technology which simply did not exist in the dialup era.  
## The second half is the revamp of the ePrivacy Directive of 2002
(You know it, somewhat inaccurately, as the “cookie law.”) This revamp, which deals with data in transit such as cookies, telemetry, metadata, and consent for marketing. ePD is still in draft but look for a deadline of late this year/beginning of 2019.
## What should you know about these changes?
**GDPR pertains to personal data**
defined as “any information relating to an identified or identifiable natural person.
Includes multiple data points or combinations that create a record
* Genetic data
* Biometric data (such as facial recognition or fingerprint logins)
* Location data
* Pseudonymized data
* Online identifiers
*This includes Sensitive personal data:* requires stricter protection-pay attention devs
* Racial or ethnic origin
* Political opinions
* Religious or philosophical beliefs
* Trade union membership
* Health data
* Sex life or sexual orientation
* Past or spent criminal convictions
Personal data is used, stored and manipulated by data controllers and data processors. 

**The controller** you or the organization you represent
**Data processor** is any entity that processes the data for the controller  

## GDPR covers only Europe, right? *NO* 

If you deal with data from any European entity (customers, users, business, etc) you need to protect it under GDPR. The fact that the USA currently doesn't have a far reaching set of laws or governances for protecting data is not a reason to push this under the rug. The US views these privacies mostly under contract and property law - right now; but remember the internet has no boundaries.  Pretty soon there will be a collision of practices about how we protect data so start doing it now as much in accordance to GDPR as you can within your purview. Data protection is not overtly protected by law - the responsibility is very much in the hands of engineers who create and implement these processes.
***

## What you can do now 

**The Privacy by Design framework** 
a seven-point development methodology which requires optimal data protection to be provided as standard, by default, across all uses and applications. 
**Privacy Impact Assessment** 
**TRAINING AND PROFESSIONAL DEVELOPMENT**include legal and industry specific and methodologies, frameworks

*Technical And Security Measures* most data breaches begin internally think access control, segregated data 
* Healthy data protection workflows 
* Avoid unnecessary data capture or loss 
* Require everyone in your project to work from a clearly defined set of code libraries, tools, and frameworks 

**Technical and security measures to address third parties** 
**Disable unsafe or unnecessary modules** ( in APIs and third-party libraries) 
**Code Reviews** 
**Minimization in front and back end UI design where data is collected**  
**Map where data is stored, protected, encrypted, and sandboxed** 
**Data should be deleted automatically or through user actions** 


## CONSENT AND SUBJECT ACCESS

### front end provide better consent mechanisms and user controls
* UI for individual subject access rights, such as the right to edit and correct 
information, the right to download data, the right to restrict processing, and the right to data deletion. (think account settings) 
* develop ways to alert users to any applicable choices and options

### On the back end, develop to enforce user consent 
* Procedures such as penetration testing 
* Test for data protection by default 
* Develop ways for the public to notify if your data has been breached 
*GDPR is really about adopting common-sense safeguards for data protection and    privacy as fundamental  parts of your development workflow. Here is the full GDPR  Code of Practice as a start in making changes* 

[ Anonymisation managing data protection risk code of practice ](https://ico.org.uk/media/for-organisations/documents/1061/anonymisation-code.pdf)
[ The Privacy by Design framework ](http://achickandaclick.com/PrivacyByDesign7Principals.pdf)
[ Privacy Impact Assessment ](http://achickandaclick.com/PrivacyImpact%20Assessment.pdf) 
 
### Key ideas 
*  Consent 
*  Notification of data breach 
*  Right to be forgotten
every individual reserves the right to ask for the deletion of their personal data   in situations when the data is no longer required