If an application processes personal data, establish its purpose, legal basis and other applicable data protection requirements. The General Data Protection Regulation (GDPR) sets out processing principles and protection requirements. Grassroot IT considers these questions during needs assessment and design.
Describe the actual processing
What information does the task need, where does it come from and who receives the results? The application profile makes these connections visible. Work with the responsible functions to determine permitted access, information for individuals, retention and deletion.
Use suitable data for development and testing. Real operational data should not be transferred into a test environment or external service merely because it is available. This also applies to inputs for artificial intelligence services.
Consider changes and replacement
New sources, additional recipients or a changed purpose may require reassessment. Examine the affected processing before adopting a change. Safeguards depend on the actual processing and its possible consequences.
During retirement, establish which data remains necessary and how it will stay protected or be deleted through approved procedures. The organisation remains responsible for assessing the particular application’s compliance.