GDPR-by-design as the standard, not an option.
For companies handling sensitive personal data, tired of hearing 'we'll add the GDPR at the end'. We build software with privacy embedded in architectural decisions: encryption, least privilege, audit log, consent, retention, data-subject rights.
What happens today.
Seven years after GDPR entered into force, too many applications are still built with privacy as 'end-of-project add-on': a cookie banner stuck on top, a template privacy policy, encryption that protects the backup but not the production database. When a Data Subject Request or an audit arrives, the software struggles to keep up.
GDPR-by-design (Art. 25 GDPR) is not a rhetorical exercise: it means explicit architectural decisions about privacy from day one. Encryption at rest and in transit, least-privilege permissions, structured audit log, configurable retention policies, explicit consent management, automated processes for data-subject rights (access, rectification, erasure, portability).
Privacy is not laid on top. It is founded. The difference shows at the first Data Subject Request.
The solution, broken into parts.
-
DPIA + privacy threat model
Data Protection Impact Assessment at design time: processing map, legal bases, purposes, privacy risks. Privacy-oriented threat model (not just security): who sees what, where data goes, real retention.
-
Privacy-by-default architecture
Encryption at rest (database, file storage) and in transit (TLS 1.3). Segregation of identifying data from sensitive data. Least privilege in permissions. Pseudonymization where possible. Structured log of every access to personal data.
-
Consent management + data-subject rights
Granular consent management, with history revocable at any time. Automated processes for data-subject rights (DSAR): data export, rectification, erasure, portability. Time-to-fulfill tracked for audit.
The typical profiles who benefit.
-
Healthcare and Art. 9 data sectors
Clinics, outpatient centers, medical offices, healthcare software houses: handling of health data with all the reinforced safeguards required by GDPR Article 9.
-
B2C software with profiling data
E-commerce, consumer apps, marketplaces, B2C fintech: marketing consent management, profiling, retention. Strict constraints on transparency and data-subject rights.
Transparency on what the client does.
Before we start we need a few accesses and decisions. All reasonable, no surprise asks.
-
Privacy scoping
- Internal DPO or privacy consultant available for the project
- List of personal-data categories processed
- Existing DPIAs or privacy policies if any
-
Architectural decisions
- Target hosting (Italy/EU required in most cases)
- Retention policies per data category
- Integrations with external systems (and their legal bases)
Indicative numbers, not quotes.
- TIME
- Typically 4-9 months for medium software. Privacy hardening adds 10-20% to the time of an equivalent non-regulated project.
- COST
- Range €50,000-250,000 depending on complexity.
- MODEL
- Fixed milestones, with DPIA and privacy threat model as first-phase deliverables.
Indicative numbers. For an accurate quote, let's talk.
Answers to the most common questions.
What does privacy-by-design mean in practice?
It means explicit architectural decisions, not compliance checks. At-rest and in-transit encryption by default. Least privilege in permissions (a user sees only the data they need for their role). Audit log of every personal-data access. Configurable, automated retention policies. Pseudonymization where possible. All integrated into the design, not added later.
Do you also handle organizational GDPR compliance?
No. We build compliant software. Organizational GDPR compliance (DPO, processing register, privacy policy, training, data-breach management) stays with you or your privacy consultant. We work well alongside the DPO: we deliver technical evidence, DPIA, exportable audit logs.
Is Italy/EU hosting mandatory?
It depends on the processing. For health data (GDPR Art. 9) and data from Italian public entities, EU hosting is almost always required by additional national policies. For other ordinary personal data, non-EU hosting is possible but requires extra safeguards (Standard Contractual Clauses, third-country assessments). Default: EU hosting.
Recognize your case?
Write a couple of lines about your context. We'll reply within 24-48 hours with an initial assessment and a first orientation on time and cost.
Let's talk