GDPR in 2025: What Every Software Developer Must Know

The ICO issued £14.2M in fines in 2024 alone, and enforcement is only intensifying. GDPR is not just a legal checkbox — it's a set of technical requirements that directly affect how you design databases, APIs, and data pipelines. Developers who understand these requirements are invaluable; those who don't are a liability.

The 6 Technical Requirements That Actually Affect Your Code

1. <strong>Data minimisation.</strong> Only collect what you actually need. If you don't use date of birth for anything, don't store it.
2. <strong>Right to erasure ("right to be forgotten").</strong> You must be able to delete all personal data for a given user within 30 days. This means your data model must track which records belong to which user — including in logs, analytics, and backups.
3. <strong>Data portability.</strong> Users can request a machine-readable export of their data. Build a data export endpoint from day one.
4. <strong>Consent management.</strong> Consent must be specific, informed, and revocable. Use a proper Consent Management Platform (CMP) — not a cookie banner that pre-ticks everything.
5. <strong>Breach notification.</strong> You have 72 hours to notify the ICO of a data breach affecting EU/UK residents. You need incident response procedures before a breach, not after.
6. <strong>Privacy by design.</strong> Security measures (encryption at rest and in transit, access controls, pseudonymisation) must be built in from the start.

The Right to Erasure in Code

// Right to Erasure implementation
async function deleteUserData(userId) {
  await db.transaction(async (trx) => {
    // Anonymise instead of hard-delete where data is needed for accounting
    await trx('orders').where({ userId }).update({
      userId: null,
      customerEmail: '[deleted]',
      customerName: '[deleted]',
    });

    // Hard delete personal data
    await trx('user_sessions').where({ userId }).delete();
    await trx('user_addresses').where({ userId }).delete();
    await trx('user_profiles').where({ userId }).delete();
    await trx('users').where({ id: userId }).delete();
  });

  // Log the erasure for your compliance record
  await auditLog.write({
    event: 'USER_DATA_ERASED',
    userId,
    timestamp: new Date().toISOString(),
    requestedBy: 'user', // or 'admin', 'legal'
  });
}