As a software developer, it is essential that your work complies with the General Data Protection Regulation (GDPR). This regulation is designed to ensure the privacy and protection of personal data within the European Union. In addition, it is important for companies such as CoolProfs, which are ISO 27001 certified, to comply with strict information security standards.

GDPR and AVG

The GDPR for The Netherlands is called the AVG. There is no difference in the requirements, except that rules may be interpreted differently in different countries within the EU. Basically, the GDPR is a comprehensive piece of legislation that applies to all organizations that process the personal data of EU citizens. One of its most important aspects is the obligation to be transparent about how data is collected, used, and protected.

In addition, the GDPR requires organizations to obtain explicit consent from individuals before processing their data, unless another legal basis applies, such as a legal obligation or the performance of a contract. Organizations must also be able to demonstrate that they have obtained this consent.

It may be required that organizations carry out a Data Protection Impact Assessment (DPIA). Check if this is the case for your organization.

Privacy by design

The GDPR places a strong emphasis on privacy by design and privacy by default. This means that software developers must take privacy and security aspects into account from the outset of the development process. When designing new products or services, developers must ensure that personal data is always properly protected.

Privacy by design means that privacy protection is built into the technology and processes. Privacy by default means that the default settings of a system are as privacy-friendly as possible.

What Can You Do?

As a software developer, you can take steps to help your organization or client comply with privacy regulations.

Design Phase

• Assess necessity of data collection: What personal data is truly needed?
• Embed privacy early in system architecture—not as an afterthought.
• Apply privacy by default: Ensure strictest privacy settings are enabled by default.

Data Minimization

• Collect only data that is strictly necessary for the intended purpose.
• Avoid collecting sensitive data unless absolutely required.
• Regularly review and delete unused or outdated personal data.

Data Protection Techniques

• Pseudonymize data for testing or analytics to mask identities.

• Implement authentication and authorization controls.
• Define and enforce role-based access via an authorization matrix.
• Use logging to track access and changes to personal data.
• Apply encryption at application, database, and transport levels (e.g., HTTPS, SSL).

Conclusion

Compliance with privacy guidelines requires a combination of technical solutions and organizational discipline. As a software developer, you contribute directly to this by embedding privacy in the design, construction, testing, and maintenance of your applications. Privacy by design is not only an obligation, it makes your software stand out.

Onno Poelmeyer, Consultant, CoolProfs