Product Structuring
When developing new software or other products that require the processing of personal data, you should always consider data compliance in the modelling and design stages.
“Data protection by design and default” is a relatively new legal requirement, but not a new concept (though it used to be called “privacy by design” – we haven’t come very far with inventive naming systems!)
In essence, it means you have to bake in data protection into your processing activities and business practices, from the initial design phase, right through to the end of the lifecycle of your products, services and systems. Data protection by default also means you only process the data that is necessary to achieve a specific purpose, minimising risk from design to end game.
Examples
You should think about how data protection slots into your business’ plans and strategy when horizon scanning and making decisions about:
* developing new IT systems, services, products and processes that involve processing personal data;
* developing organisational policies, processes, business practices and/or strategies that have privacy implications;
* drawing up and reviewing new physical products designs;
* embarking on data sharing initiatives; or
* using personal data for new purposes as a business
These are broad categories, so if you're not sure, it's best to ask the experts!