At Lizard Global, the privacy of our clients and their users is our top priority when it comes to creating our digital solutions. That’s why we make sure that the tools we use and the technologies we implement are always aligned with the latest laws and regulations regarding data privacy. One of these regulations is the European Union’s GDPR or General Data Protection Regulation. In this blog, we find out how the GDPR came into effect, and how it impacts the apps you’re using in your daily lives.

What is GDPR?

The European Union's General Data Protection Regulation (GDPR) is an important and globally influential data and privacy law. The GDPR applies to anything that collects and processes personal data of EU users - including apps, websites, and other digital solutions. If data is collected for any EU citizen (even if that data is collected by a company located outside the EU or if the data is used outside the EU, the GDPR still remains in effect. The main goal of the GDPR is to provide EU individuals with privacy protection and more control over their own personal information. At the same time, the GDPR aims to improve how companies handle personal consumer data. Any business that performs transactions in the EU or collects and processes EU citizens’ data is subject to the GDPR’s protection regulations. If these companies fail to comply, they’re facing serious consequences, like hefty fines or worse. So, if you have EU users, regardless of where your organization is located, you should always make sure to comply with the GDPR.

The GDPR consists of a total of 99 articles that include a wide range of privacy requirements, such as:

• Users must give their explicit consent before personal data is being collected
• Data security should be built in and is enabled by default
• Users have the right to always have access to their personal data
• Data portability is a legal right
• Users have the right to have their data removed when requested
• Users have the right to know when their personal information has been compromised

A short history lesson

The EU's data protection policies have always been seen as a global golden standard. And while technologies have changed immensely over the past few years, regulations have had to keep up. One of the EU's greatest triumphs in recent years was the introduction of the General Data Protection Regulation (GDPR) in 2016. It follows up the 1995 Data Protection Directive, which was introduced when the internet just entered most of our lives. Seeing the difference between the internet right after its emergence and its ubiquity in our current lives, you can imagine that the regulations within the Data Protection Directive were not aligned with the current state of the internet and personal data use any longer.

The GDPR came into force in May 2018. By that time, any business active in the EU had to make sure that their company was strictly following the GDPR laws. To ensure that organisations comply with the GDPR, some companies, such as those whose main activities include regular and systematic monitoring of personal or sensitive data on a large scale, as well as public sector organizations, are required to employ a Data Protection Officer who makes sure that the regulations are followed at all times.

Data privacy in mobile apps

A significant difference between the time of the 1995 Data Protection Directive and the current General Data Protection Regulation is the emergence of the smartphone and mobile apps in particular. While the internet used to be a convenient accessory in the ‘90s and ‘00s, it has now become an extension of our daily lives. We rely on our smartphones for staying connected with our friends and family, for making, storing and sharing our pictures, for booking rides, buying clothes, ordering food, you name it. All these applications possess their own functionalities, and they all require at least some kind of personal information from you. This could include something as simple as your name and email address, or something as sensitive as your bank credentials or your home address.

We often don’t hesitate to provide our apps with our personal data, especially if it means you can make use of a product or service without having to pay for it. But while many applications such as Facebook, Instagram, and TikTok, are free to install and to use, we often don’t realize that our personal information is the currency we use to pay for these services. Shortly said, the amount of personal data that’s going around on the internet is immense, and requires a very solid set of rules in order to make sure this data doesn’t fall into the wrong hands or is used maliciously.

Want to know how we ensure the privacy of our user data in every single application we create? Check out our security documentation, which tells you all about the technologies we use to develop our apps as securely as possible.

GDPR and App Development

In order to ensure compliance with the GDPR rules, mobile app creators and owners will need an app-specific solution to safeguard data flowing to and from mobile devices, as well as many built-in controls for users to manage their data.

1. Consent

Before collecting or processing personal information, one of the most critical obligations of the GDPR is to obtain active, informed consent from the users of an application. Many apps used to presume that when a user proceeded with the registration process of an app, they inherently gave consent to use their personal data. However, this isn't the case anymore. Before any personal data is gathered, the GDPR mandates that apps obtain the user's active and informed consent. Nowadays, this is usually presented to the user as a checkbox to agree with the “Terms and Conditions”. If a user agrees with the terms and conditions of an app but wants to restrict the use of their data later on, the app owner must comply immediately.

2. Access

In addition to giving consumers the ability to control their consent to collect and use their data, the GDPR also provides mobile app users with additional rights to govern the use of their data. Mobile app creators must state these rights in their Privacy Policy so that users can read into it if they want to know more about it. If a user requests information under the GDPR, app creators must comply with the request and give the information requested by the user. App owners have a specific amount of time to complete the request, which can be extended if the data is too complex to obtain and send to the user within a limited time.

3. Portability

Users have the right to "data portability" in circumstances where data is handled by automated devices or machines. This means that users who share their data with a mobile app have the right to send it to another mobile app or business without the app owner’s knowledge or permission. The end-user might also give the app owner permission to send their personal information to a third party for any reason. Unless the request would be in violation of a law or a court order, the owner must comply with user requests to send personal data under the GDPR.

4. Removal

The GDPR grants users of mobile apps the right to have their data removed, which is also known as the "right to be forgotten." App users can request to have their personal data erased if it is no longer required for the reason for which it was acquired or processed. Users may also withdraw their consent for their data to be used if they object to the processing of their data or discover that their data is being treated unlawfully. The best approach to comply with this is to make sure that a mobile app allows users to completely deactivate their accounts, and that the app destroys all of the user data if this happens.

5. Transparency

Transparency is another essential requirement of the GDPR. This means that individuals have the right to know who is collecting their data and for what purpose. The information should be simple to find and understand and should be free of charge. Users of a mobile app should be given information that is concise, easily accessible, and written in a language that is easy to understand by the end-user.

6. Necessity

Another key piece of GDPR is that app developers (or data collectors) can only request data that their systems need in order to function. For example, they can't require a user to give his/her home address if they don't really need it for the solution to function. To be on the safe side, it's always best to only ask for the information the solution actually needs in order to provide the best user experience and nothing more

Data protection at Lizard Global

The GDPR requires data controllers and processors like app creators and owners to take reasonable steps to protect the privacy of their users. At Lizard Global, our applications are built with “privacy by default”. Privacy by default refers to the fact that app developers make sure that their application is built and marketed with the most secure privacy settings by default. The settings must be configured in such a way that, whenever a user starts using the app, they only provide the data that is absolutely necessary in order to use the app’s functionalities.

Do you want to know how you can make your own application as secure as possible? Check out this article with 5 tips and tricks to optimally secure your app.

For every application we create, we make sure that no one has access to user data, only when absolutely necessary. We assess the security risks associated with all of our digital solutions and ensure that access is only granted when it is absolutely essential. We prioritize the security of your user data by ensuring that our technology is written in such a way that it only requires minimum access to user data to function properly. A social media platform should be encouraged to allow users to configure their profile settings in the most privacy-friendly ways possible, such as limiting the visibility of a user's profile from the start so that it is not accessible by default to an endless number of people.

Besides privacy by default, we also make sure that we continuously use the latest cutting-edge data protection technologies, such as encryption protocols and blockchain technologies. In the event of a physical or technological problem, we must make sure to quickly restore the data and make it available again without losing its protection. As a full-stack app development partner, it is also our responsibility to continuously test, assess, and evaluate the security of our applications. User data must be safeguarded at all times, both during the process of data processing and on the user's device itself.

Need a hand?

Are you looking for a digital partner for the development of your application? At Lizard Global, no challenge is too big. We walk you through the entire process of app development, and make sure your app is in line with your target audience and your market and industry, using cutting-edge technologies and following the latest laws and regulations in cybersecurity.

Ready to team up? Fill in our contact form and receive a free digital consultation session with our experts in the field to find out how we can start an award-winning partnership!