What GDPR actually requires of an engineering team

Does GDPR apply if our servers are not in Europe?

Server location is not the test. Article 3 applies the regulation where processing happens in the context of an establishment in the EU, and separately where an organisation outside the EU offers goods or services to people in the EU or monitors their behaviour. A company hosted entirely in another region that sells to EU customers and runs analytics on them is in scope. The UK operates a parallel regime under UK GDPR and the Data Protection Act 2018, and UK law has been amended by later legislation, so confirm the current UK position separately rather than assuming the two texts still match.

The practical consequence for engineers is that hosting region is a transfer question and a residency question, not a scope question. Moving a database to Frankfurt does not remove an obligation, and keeping it in Ohio does not create one that was not already there.

Where you operate across several regimes, the useful move is to build to the strictest requirement in your set and record which jurisdiction drove each decision. Retrofitting a second regime into a system built for one is the expensive path.

Which obligations turn into actual build work?

Seven of them, and they produce different artefacts. Article 5 principles and Article 6 lawful basis produce a per-purpose register that has to match what the code does. Article 30 produces records of processing. Article 25 requires data protection by design and by default, which lands as defaults in schemas, logging and forms. Article 32 requires security measures appropriate to the risk, including a process for testing them. Articles 12 to 22 require the machinery to answer subject requests inside a deadline. Article 28 requires processor contracts whose terms constrain your architecture. Articles 33 and 34 require detection and notification inside a fixed clock.

The table below maps each to the thing an auditor, a regulator or an enterprise buyer will actually ask to see. Notice that the failure mode in every row is the same shape: the document exists and the system cannot do what the document says.

What does accountability mean in practice?

It means the burden of proof sits with you. Article 5(2) requires the controller to be able to demonstrate compliance, which turns every good intention into an evidence question. Not whether access is restricted, but whether you can produce the current list of who holds production access and when it was last reviewed. Not whether data is deleted, but whether you can show a specific record leaving every store.

This is why so much privacy engineering work is really instrumentation. A control that runs but leaves no record is indistinguishable from one that never ran, and that distinction is the whole of an audit. Generating evidence as a side effect of the control working is far cheaper than reconstructing it under deadline.

The test to run this week: pick one control you are confident in, and try to produce twelve months of evidence for it without asking a person to remember anything. Most teams discover that the control is fine and the record is missing.

Where do engineering teams most often fall short?

In the gap between the primary database and everywhere else the data went. Deleting a row is easy. Deleting the same person from the search index, the analytics warehouse, the event log, the cache, the log platform, the support tool and the staging environment seeded from a production restore is a distributed systems problem that nobody scoped, and it is the single most common finding.

The second is logging. Application logs, proxy access logs, tracing spans and error reports quietly become the largest personal data store in the estate, with the longest retention and the widest access, because nobody classified them as personal data. Any identifier in a URL path or query string ends up in several of these at once.

The third is that the record of processing was produced by a questionnaire. Engineers create data flows continuously and the register is refreshed annually, so the two diverge from the day it is signed off. The fix is deriving the map from the infrastructure rather than from memory, which the sibling guide on data mapping covers in detail.

When do you need a DPIA or a data protection officer?

A data protection impact assessment is required before processing likely to result in a high risk to individuals, and Article 35(3) names systematic and extensive automated evaluation with significant effects, large scale processing of special category data, and large scale systematic monitoring of a public area. Supervisory authorities also publish their own lists of processing that always requires one, so check the list for your lead authority rather than reasoning from the article alone.

The engineering relevance is timing. A DPIA is meant to run before the processing starts, which means before the architecture is fixed, because its output is supposed to change the design. Completed after launch it becomes a description rather than an assessment, and it will read that way to anyone reviewing it.

A designated data protection officer is required for public authorities and where core activities involve large scale regular and systematic monitoring or large scale special category processing. Plenty of organisations appoint one voluntarily, which is fine, but the role carries independence requirements that a nominal appointment does not satisfy.

What should you build first?

Subject identity resolution, because everything else depends on it. If you cannot reliably answer which records across which systems belong to one person, you cannot answer an access request, cannot enforce deletion, cannot scope a breach and cannot honour an objection. It is the shared primitive under four separate obligations and it is almost never anyone's project.

Second, retention with a mechanism rather than a schedule. A store that expires data by policy configuration keeps working when the person who wrote the policy leaves, and it makes the deletion problem smaller every day it runs.

Third, an incident route with a named person who can decide notifiability outside working hours. The 72 hour clock in Article 33 is short, it includes weekends, and the part that consumes it is not the writing but the internal question of who is allowed to make the call.