GDPR
GDPR is the EU regulation that governs how personal data about identifiable people may be collected, stored and used. It applies to any organisation processing data about people in the EU, regardless of where the organisation is based, and it requires a documented legal basis for every processing activity.
What counts as personal data
Broader than most people assume. Not only names and email addresses, but IP addresses, device identifiers, cookie IDs, location traces and user IDs — anything that can identify someone directly or in combination with other data. Health data, biometrics, ethnicity, political opinions and sexual orientation are special categories with stricter rules on top.
Every processing activity needs one of six legal bases. In practice three matter for most apps: consent (freely given, specific, as easy to withdraw as to give), contract (you cannot deliver the service without the data), and legitimate interest (documented, balanced against the individual's rights). Picking consent for something you actually need under contract creates a problem, because withdrawn consent then obliges you to stop.
The rights that shape how you build
Individuals — data subjects — can request access to their data, correction, erasure, restriction, portability in a machine-readable format, and object to certain processing. You generally have one month to respond.
Two of these have direct architectural consequences. Erasure (article 17) means deletion has to be real, which rules out a soft-delete flag as the only mechanism and forces a decision about backups. Portability means the data needs to come out in a structured format, not just be visible on a screen.
This is why an app built on NorthernGo that has login is required to include a working account deletion function. It is not a nice-to-have; it is the article 17 obligation expressed in code.
What GDPR is not
It is not a cookie banner law — that is the ePrivacy Directive, which is why consent for non-essential cookies is required before they are set. It is not a ban on storing data outside the EU, though transfers need a valid mechanism. And it is not satisfied by a privacy policy alone: the obligations are about what you actually do, including data minimisation, retention limits, security measures, records of processing, and written agreements with each data processor you use.
This entry explains the concepts; it is not legal advice. For anything with real exposure, consult a qualified adviser.
Frequently asked questions
Does GDPR apply to a small app with only a few users?
Yes. There is no minimum size threshold. Some obligations scale — organisations under 250 employees have lighter record-keeping duties in limited circumstances — but the legal basis, the rights of individuals and the security requirements apply from the first user. This is an explanation, not legal advice.
Build it yourself
NorthernGo turns a plain-text description into a working web app with a database, login and a live URL. Local AI generation runs on your own GPU, is unlimited, and is free on every plan.