GDPR: Treating User Data as a Liability, Not an Asset

THE MENTAL MODEL: GDPR treats personal data not as a corporate asset, but as a fundamental human right belonging to the individual. Companies are merely custodians or "processors" of this data, borrowing it with explicit consent for specific purposes. This shifts the engineering default from "collect everything" to "collect only what is necessary for a specific, stated purpose."

HOW IT WORKS: The General Data Protection Regulation is a unified data privacy law from the European Union. It applies to any organization that processes the personal data of individuals inside the EU and EEA, regardless of where the organization itself is located. It grants a set of rights to individuals (called "data subjects"), including the right to access their data, correct inaccuracies, and request its complete deletion. It also governs the transfer of personal data outside the EU, requiring that the destination has adequate data protection laws or that other safeguards are in place.

WHEN TO USE IT: Compliance is a legal requirement, not a feature. You must adhere to GDPR if your service processes the personal data of anyone residing in the EU. This applies to common engineering tasks like storing user profiles in a database, collecting emails for a newsletter, or tracking user behavior with analytics tools. The definition of "personal data" is intentionally broad, covering anything from names and emails to IP addresses and location data.

WHEN NOT TO USE IT: GDPR's rules do not apply to data that has been truly and irreversibly anonymized, as it can no longer be linked to an identifiable person. It also carves out an exception for data processed by an individual for purely personal or household activities. For any commercial system or service, however, if there's any connection to an EU resident's personal information, GDPR is almost certainly in scope.

ONE CANONICAL EXAMPLE: A US-based SaaS company has customers in France. A French customer, exercising their "right to access," requests a copy of all data the company holds on them. Under GDPR, the US company is legally obligated to provide this data in a common machine-readable format. If the customer later requests deletion, the company must erase their personal data from all systems, including production databases, backups, and third-party analytics services. Failure to comply can result in significant fines.