---
title: 'Protect personal data in applications'
url: 'https://grassroot.it/en/artikel/datenschutz-in-anwendungen'
markdown: 'https://grassroot.it/en/artikel/datenschutz-in-anwendungen.md'
lang: en
date: '2026-11-11'
description: 'If an application processes personal data, establish its purpose, legal basis and other applicable data protection requirements. The General Data Protection Regulation (GDPR) se…'
taxonomy:
  category:
    - Values
---

Values 11.11.2026

# Protect personal data in applications

If an application processes personal data, establish its purpose, legal basis and other applicable data protection requirements. The General Data Protection Regulation (GDPR) sets out pro…

 ![Protect personal data in applications — symbolic illustration](https://grassroot.it/user/pages/03.artikel/23.datenschutz-in-anwendungen/cover.png) 

If an application processes personal data, establish its purpose, legal basis and other applicable data protection requirements. The [General Data Protection Regulation (GDPR)](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng) sets out processing principles and protection requirements. Grassroot IT considers these questions during needs assessment and design.

## Describe the actual processing

What information does the task need, where does it come from and who receives the results? The [application profile](https://grassroot.it/en/artikel/anwendungssteckbrief) makes these connections visible. Work with the responsible functions to determine permitted access, information for individuals, retention and deletion.

Use suitable data for development and testing. Real operational data should not be transferred into a test environment or external service merely because it is available. This also applies to inputs for [artificial intelligence services](https://grassroot.it/en/artikel/ki-entwicklung-pruefen).

## Consider changes and replacement

New sources, additional recipients or a changed purpose may require reassessment. Examine the affected processing before adopting a change. Safeguards depend on the actual processing and its possible consequences.

During [retirement](https://grassroot.it/en/artikel/ausserbetriebnahme), establish which data remains necessary and how it will stay protected or be deleted through approved procedures. The organisation remains responsible for assessing the particular application’s compliance.

---

## Navigation

- Parent: [Articles](https://grassroot.it/en/artikel.md)
- Previous: [Include information security in small applications](https://grassroot.it/en/artikel/informationssicherheit.md)