# GDPR

> GDPR is the EU regulation that governs how personal data about identifiable people may be collected, stored and used. It applies to any organisation…

Source: https://northerngo.com/glossary/gdpr/
Language: en
Updated: 2026-08-28

---
**GDPR is the EU regulation that governs how personal data about identifiable people may be collected, stored and used. It applies to any organisation processing data about people in the EU, regardless of where the organisation is based, and it requires a documented legal basis for every processing activity.**

### What counts as personal data

Broader than most people assume. Not only names and email addresses, but IP addresses, device identifiers, cookie IDs, location traces and user IDs — anything that can identify someone directly or in combination with other data. Health data, biometrics, ethnicity, political opinions and sexual orientation are special categories with stricter rules on top.

Every processing activity needs one of six legal bases. In practice three matter for most apps: **consent** (freely given, specific, as easy to withdraw as to give), **contract** (you cannot deliver the service without the data), and **legitimate interest** (documented, balanced against the individual's rights). Picking consent for something you actually need under contract creates a problem, because withdrawn consent then obliges you to stop.

### The rights that shape how you build

Individuals — *data subjects* — can request access to their data, correction, erasure, restriction, portability in a machine-readable format, and object to certain processing. You generally have one month to respond.

Two of these have direct architectural consequences. **Erasure (article 17)** means deletion has to be real, which rules out a soft-delete flag as the only mechanism and forces a decision about backups. **Portability** means the data needs to come out in a structured format, not just be visible on a screen.

This is why an app built on NorthernGo that has login is required to include a working account deletion function. It is not a nice-to-have; it is the article 17 obligation expressed in code.

### What GDPR is not

It is not a cookie banner law — that is the ePrivacy Directive, which is why consent for non-essential cookies is required before they are set. It is not a ban on storing data outside the EU, though transfers need a valid mechanism. And it is not satisfied by a privacy policy alone: the obligations are about what you actually do, including data minimisation, retention limits, security measures, records of processing, and written agreements with each [data processor](/glossary/data-processor/) you use.

This entry explains the concepts; it is not legal advice. For anything with real exposure, consult a qualified adviser.

---

NorthernGo is an AI-powered platform for building production-ready web apps with zero coding. Local AI generation via WebGPU is unlimited and free, and you own all generated source code. https://northerngo.com/