General information, not legal advice. UK data protection law is amended from time to time (for example by the Data (Use and Access) Act 2025). Check current Information Commissioner's Office (ICO) guidance and take advice for your own circumstances.
The principles that shape your design
Article 5 of the UK GDPR sets out principles that translate directly into engineering decisions:
- Data minimisation: personal data must be adequate, relevant and limited to what is necessary for the purpose.
- Storage limitation: do not keep it in identifiable form for longer than necessary.
- Integrity and confidentiality: protect it with appropriate security.
Article 25 requires data protection by design and by default, and Article 32 requires appropriate technical and organisational measures for security, naming pseudonymisation and encryption among the examples.
Turning principles into practice
- Map your data. Know what personal data you hold, where it flows and why. You cannot protect or delete what you cannot find.
- Challenge every field. If a form field or database column has no clear purpose, do not collect it.
- Automate retention. Set retention periods per data type, then enforce them with scheduled deletion or expiry (TTLs), not a policy document nobody runs.
- Pseudonymise where you can. Analytics and testing rarely need real identities. Use tokens or hashed identifiers, and never copy production personal data into test environments.
- Design for people's rights. Be able to find, export and erase one person's data across databases, search indexes, logs and downstream systems. Decide in advance how backups are handled.
- Control and log access. Role-based access, least privilege and audit trails on sensitive records.
- Assess high-risk processing. A Data Protection Impact Assessment (DPIA) is required for processing likely to result in high risk, and it is the right time to catch design problems.
- Plan for breaches. Where a personal data breach is likely to result in a risk to people's rights and freedoms, it must generally be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. Practise the process before you need it.
Make the secure choice the easy choice
The best privacy controls are defaults in your frameworks and templates: new tables get retention metadata, new fields require a stated purpose, and new services are created with logging and least-privilege access already on. Engineers then follow the right path without having to remember it.