Data protection

Building UK GDPR into a business system from the start

The data protection features to specify at the beginning, rather than add later.

· 1 min read · Neturon

A software team working together at their desks.

UK GDPR asks for data protection by design and by default. In practice that means a handful of features that are cheap to build in at the start and expensive to retrofit. This is general guidance, not legal advice.

Features to put in the specification

  • Role-based access, so each person sees only what their job needs.
  • An audit trail of who viewed or changed sensitive records.
  • Retention rules that flag or remove records once they are no longer needed.
  • A way to find, export and correct one person's data, for access and correction requests.
  • Encryption in transit and at rest, and secure handling of uploaded documents.
  • Strong sign-in, including multi-factor authentication for staff.

Collect less

Every field on a form is data you must protect, keep accurate and eventually delete. Ask whether each one is genuinely needed for the purpose you have described to people.

Suppliers and records

Hosting providers and other processors need written contracts, and international transfers need appropriate safeguards. Keep a simple record of what personal data the system holds, why, and for how long. The ICO publishes clear guidance for organisations of every size.

Related service

Business Software, CRM & ERP

If this matches a piece of work you are planning, tell us about it and we will suggest a sensible first step.

Discuss your projectAbout this service

General guidance only. It is not legal, financial or regulatory advice, and it does not describe the results of any client project.

More insights