Best Practices for GDPR Mobile App Development

Come May 25th, 2018, the European Online Data Privacy law, which was passed in January will be enacted. For organizations that handle or process personal data of European citizens, this means having to implement measures to meet the regulations laid down by GDPR, as failure to do so can attract huge fines in the range of €1 million or 2% of the global turnover or €2 million or 4% of the global turnover, depending on the sensitivity of the data.

What is GDPR?

The General Data Protection Regulation (GDPR) is designed to protect the way in which data of any European citizen is collected, processed and stored. Additionally, it places importance on the ability of the user to control personal data, including provisions to port, opt-out or remove their data whenever they want.

For mobile app developers, this means ensuring that their apps not only include systems that allow opt-in, collection and storage of personal data of the user but also the necessary infrastructure to opt-out or forget the user’s data as part of the compliance required by the Act.

Points to consider for making an app GDPR compliant

1. Consent Under GDPR

It’s vital to obtain user consent before storing cookies, saving data on the cloud or through third-party apps or before tracking user behavior or activities. As per the guidelines of GDPR, consent must be freely given, specific and unambiguous. This means that the user should agree to his data being collected. Additionally, the consent should clearly define the specific data being collected, stored or processed. The terms and conditions, as well as privacy policy, must be worded in simple language that is easy for any user to comprehend.

Separate consents need to be obtained for each type of process. For example, at the time of opt-in, the user accepts the terms & conditions and privacy policy, but this cannot be taken as a blanket consent for opting in for other services offered by the app

2. Purpose of collection of Data Under GDPR

• Secured protocols like https should be used to transfer data on the network.
• Single sign-in protocols such as OAUTH can be used to allow users to create an account by linking another account. This way, no data other than the authentication ID is stored by the app.
• Sensitive information such as passwords should be hashed and saved to encrypted databases with restricted access to IPs.
• Cookies should be destroyed after a period of inactivity or after logout.

At TechAhead, we are geared to help companies build apps to comply with the new regulation that keeps personal data secure while providing a superior experience to the user. During the design process, we evaluate and collect only the essential data required to provide insights and analytics to help companies understand their audience without going against the regulations of GDPR.