Outsourced Privacy Engineering Team

When launching a software on EU market you may face the following issues:

1. During the development process, you have realized that your product does not comply with the strict rules of the European Union or marketplace for data protection. It is the risk of a huge multimillion fine, non-admission or ban of the app in marketplaces, a drop in the company's value, loss of customers, and damage to reputation. You need to change something urgently, before bringing your product to the final stage of development. Otherwise, it will be too late, and you will just have to close the project, losing the invested funds and time.
2. You are not starting the development because you do not know which of the many GDPR requirements apply to your product. Because of this, deadlines are missed, and each month of delay means lost profits and opportunities.
3. You are trying to build privacy into the product, but you are acting at random, and you are not sure of the effectiveness of your solutions. You may be doing unnecessary work or complicating things that can be made easier. Probably, you will have to make changes and incur unplanned losses. Will the product be as profitable for you as it was before?
4. You are a customer of the application/site/system and hope that due to contractual conditions, the developer will embed privacy into the product. However, you don't know how to make a specification so that it complies with the GDPR, or don't know how to perform acceptance testing of the product to ensure full compliance of the product with the GDPR.
5. You want to win or have already won a dream tender. Your client has sent you a questionnaire with questions about the GDPR and Privacy by design. Unfortunately, you do not know how to answer them correctly, how to prepare for the annual client's audit, or whether your product meets the requirements of the tender.
6. Users have started to request or ask to delete their data frequently. You respond to everyone on time, but users address regulatory authorities with a complaint that you have been storing their data for too long or unreasonably.
7. You are a developer and have found a dream job/contract, but you need expertise and experience in applying the GDPR or Privacy by design.

Of course, you can figure out everything by yourself, become an expert, and advise your company. However, it will be a thorny path of trial and error that may last for several years.

If you need to create or modify a privacy-friendly product that complies with the GDPR in a short time, then our outsourced Privacy Engineering Team is ready to solve this problem.

1. It conducts software audits (at the stage of current or planned implementation). It helps you to formulate an accurate list of requirements (the corresponding section of the terms of reference) that relates specifically to your product, saving you from unnecessary work.
2. It effectively interacts with project stakeholders and contributes to the implementation of the GDPR in the software, and, if necessary and at your request, makes improvements to your code.
3. It tests your employees' knowledge and gives them all the necessary knowledge and skills for further independent support.
4. It advises your specialists and formulates tasks for changes and improvements to comply with the GDPR.
5. It configures product development processes in accordance with data protection legislation.
6. It conducts audit and product acceptance testing for compliance with the GDPR.
7. (option) It creates and trains a similar Privacy Engineering Team within your company that can further implement privacy in all your future products.

Step 1.

We make a product audit: we determine the need and possibility of a PETeam intervention. For example, we've looked at a small product and have made one of the following expert assessments: 1) changes are necessary and possible; 2) you do not need any changes; 3) it is cheaper to rewrite it from scratch.

Step 2.

If we decide to join your project, an onboarding of our team is carried out. We study the goal, processes, architecture, style, design, data flows, and processing, and get familiar with the development methodology in the team. We select personal data in the data model and where and how they are stored and processed.

Step 3.

We plan further improvements by developing a list of tasks (scope of the work), stages, blocks, evaluating them, and planning sprints.

Step 4.

We participate in team development, consulting, meetings, and brainstorming. We participate in the testing and finalization of the product.

Step 5.

We conduct a final product audit, acceptance testing, and prepare the report.

Results: optimization of processes (workflow), added required functionality (automatization of the exercise of the subject's rights, setting up system rules for data deletion, and development of customized documentation (privacy notice, checkboxes, cookie banner, DPA, SCC, Declaration of GDPR compliance, etc.)). Your team gains experience and knowledge in the implementation of the upcoming projects and tasks.