GDPR-Compliant Software Development
We architect products for GDPR and UK GDPR compliance: data minimization, DSAR support, lawful basis, retention controls. Built in, not bolted on.
Our status against GDPR
Compliant builds
We architect products so you can achieve GDPR compliance. We are typically your data processor; you remain the data controller and own those responsibilities.
| Requirement | Status | Note |
|---|---|---|
| GDPR-compliant builds | Met | Default for every product we ship with EU/UK users. |
| UK GDPR / Data Protection Act 2018 | Met | Same architecture; UK-specific nuances handled. |
| Lawful basis documentation | Met | We architect to support whichever lawful basis you choose. |
| DSAR (Data Subject Access Request) support | Met | Built into data architecture from day one. |
| Data minimization | Met | We collect what's needed, not what's easy. |
| Cookie consent | Met | GDPR-compliant cookie banner deployed on the Robust Devs site (production reference). |
| Records of Processing Activities (RoPA) | Partial | We help clients build the initial RoPA; ongoing maintenance is their responsibility. |
| DPO appointment (Robust Devs) | Partial | Not applicable: we are not required to appoint a DPO ourselves. |
Thirty days, and who is doing what in them
DSAR support is one row in the table above. It is also the control most likely to fail, because the clock is legal and the work is split across three parties.
What this means for your build
- We architect products with GDPR principles baked in: data minimization, purpose limitation, retention, accuracy, and security.
- We support whichever lawful basis you've chosen: consent, contract, legitimate interest, and the rest.
- We architect DSAR endpoints so subject access, rectification, erasure, and portability requests can be fulfilled programmatically.
- We are typically your data processor, not your controller; a Data Processing Agreement (DPA) is available on request.
- We follow EU data residency requirements when required, selecting deployment regions accordingly.
How we ship GDPR-compliant code
Data minimization
We collect only what is specified, not "everything just in case."
Lawful basis architecture
Architecture supports lawful basis tracking per data category.
DSAR endpoints
Subject access, rectification, erasure, and portability: programmatically supported.
Retention controls
Automated retention policy enforcement, not manual cleanup.
Cookie consent integration
GDPR-compliant banner with granular preferences (used on the Robust Devs site).
Audit logging
Who accessed what data, and when, for DPO and DSAR purposes.
Data residency
EU / UK deployment regions when required.
Cross-border transfer mechanisms
SCCs (Standard Contractual Clauses) and adequacy decisions handled at the architecture level.
What GDPR does NOT cover
- GDPR is EU/UK only; the US has different state laws (CCPA, CPRA, Virginia VCDPA, and others).
- GDPR does not replace HIPAA; US healthcare data has separate rules.
- GDPR does not replace PCI DSS; payment card data has separate rules.
- GDPR compliance is not ISO 27001 certification; that covers information security management.
- GDPR is a legal framework; our role is technical architecture, not legal opinion.
When you need a separate consultant
We engineer for GDPR; we are not a law firm or a certifying body. Bring in a specialist when you need:
- Data Protection Officer (DPO) appointment: required for some organizations.
- DPIA (Data Protection Impact Assessment) for high-risk processing: a privacy attorney or DPO.
- Cross-border transfer legal analysis: a privacy attorney.
- DSAR response handling at scale: dedicated tooling (OneTrust, DataGrail) or an in-house process.
- Privacy policy and cookie policy drafting: a privacy attorney.
Industries where GDPR applies
AI Marketing
Ad platforms, outbound engines, AEO tools, and content engines.
- AI ad-creative platforms
- Outbound + enrichment engines
- Content + AEO tooling
AI Fintech
Underwriting, risk, fraud, and document-intelligence pipelines.
- Underwriting + risk models
- Fraud detection
- Document intelligence
AI Healthtech
Clinical assistants, triage, and medical-document workflows.
- Clinical copilots
- Triage + intake
- Medical document workflows
Work we've shipped with GDPR requirements
CheckyPro
A custom checkout and payment platform for Shopify merchants: gateway integration, Apple Pay and Google Pay, multi-store installs, disputes and settlement reporting.
9 stalled pull requests and a 3-week bug backlog cleared; 3 held features then shipped.
Draft Deputy
A Shopify app that inverts order entry for live sellers: scan the product, and the draft order builds itself.
30+ SKUs scanned into one Shopify draft order; the old version choked on large ones.
2250
A 60-second skin scan on a pharmacy shelf that resolves into one of more than a thousand personalised formulas, handed to the customer the same visit.
1,000+ skincare formulas resolved from a 60-second phone scan in 55+ San Pablo pharmacies, before the customer leaves the store.
Free tool
Tech Audit Checklist
A founder-grade checklist for pressure-testing your architecture before it scales: security, data handling, and the gaps that bite later.
Get the free checklistCompliance lives in the architecture, not in a policy document
Encryption at rest, access controls, audit logging, and immutable decision trails are wired into the build from the first sprint. The posture on this page reflects how we actually ship.
Frequently asked questions
We ship GDPR-compliant builds. We are typically your data processor; you are the data controller. A DPA is available on request.
Serving EU or UK users? Schedule a meeting.
No account managers. No compliance theatre. A direct conversation about your data architecture and what GDPR-by-design takes to ship.