Outsourced Privacy Engineering Team

If your IT product is aimed at the European market, you may have the following questions:

1. During the development process, you realized that the product doesn't comply with the strict rules of the European Union or the marketplace for working with personal data. This is the risk of a huge multimillion-dollar fine, non-admission or ban of the app in marketplaces, a drop in the company's value, loss of customers, and damage to reputation. And you need to change something urgently, without bringing it to the final stage of development, otherwise, it will be too late and you will just have to close the project, losing the invested funds and time.
2. You don't start development because you don't know which of the many GDPR requirements apply to your product. Because of this, deadlines are disrupted, and each month of delay means lost profits and opportunities.
3. You are trying to build privacy into the product, but you are acting at random and are not sure of the effectiveness of your solutions. You may be doing extra work or complicating things that can be made easier. You may have to make changes and incur unplanned losses. Will the product be as profitable for you as it was before?
4. You are a customer of the application site and hope that due to contractual conditions, the developer will embed privacy into the product "turnkey", but don't know how to make a specification so that it complies with GDPR, or don't know how to perform acceptance testing of the product, to ensure full compliance of the product GDPR.
5. You want to win or have already won the dream tender, but the client sent you a questionnaire with questions about GDPR and Privacy by design and you don't know how to answer correctly, how to prepare for the annual audit of the client, or whether your product meets the requirements of the tender.
6. Users often request their data or ask to delete their data. You respond to everyone on time, but users contact the regulatory authorities with a complaint that you have stored their data for too long or unreasonably.
7. You are a developer and have found a dream job/contract, but the requirement is knowledge and experience in applying GDPR or Privacy by design.

Of course, you can figure out everything yourself, become an expert and consult your company, but relying on our experience, it will be a thorny way of trial and error for several years.

If it is important for you to create or modify a product that is friendly to privacy and complies with GDPR in a high-quality and short time, then our outsourced Privacy Engineering Team is ready to solve this problem.

1. Software audits (at the stage of current or planned implementation). It helps you formulate a clear list of requirements (the corresponding section of the terms of reference) that relate specifically to your product, thereby saving you from unnecessary work and unproductive actions.
2. Effectively interacts with project stakeholders and contributes to the implementation of GDPR in the software and, if necessary and at your request, makes improvements to your code.
3. Tests the knowledge of your employees and passes them all the necessary knowledge and skills for further independent support.
4. Advises your specialists and formulates tasks for changes and improvements to comply with the GDPR.
5. Configures product development processes in terms of personal data protection.
6. Audits and acceptance testing of  the product for compliance with the GDPR.
7. (option) Creates and trains a similar Privacy Engineering Team within your company that can further implement privacy in all your future products.

Step 1.

Make a product audit: determine the need and Possibility of PETeam intervention. For example, we looked at a small product and made an expert assessment: 1) changes are necessary and possible, 2) you do not need changes, 3) it is cheaper to rewrite it from scratch.

Step 2.

If we have decided to join your project, our team is Onboarding. Study the goal, processes, architecture, style, design, data flows and processing, and get familiar with the development methodology in the team. We select personal data in the data model, where and how it is stored and processed.

Step 3.

Planning for improvements. Developing a list of tasks (scope), stages, blocks, evaluating them, and planning sprints.

Step 4.

Participation in development as part of a team, consulting, meetings, brainstorming. Participation in the testing and finalization of the product.

Step 5.

Final product audit, acceptance testing, and report preparation.

Results: process optimization( workflow), adding the required functionality (automating the implementation of subject rights, configuring system rules for data deletion, developing customized documentation (privacy notice, check boxes, cookie banner, DPA, SCC, Declaration of GDPR compliance, etc.), your team gains experience and knowledge to implement the following projects and tasks.