GDPR put data practices into the software contract

Article 5 set out principles including purpose limitation, data minimisation and storage limitation. Article 25 required appropriate measures for data protection by design and by default, taking account of the processing and its risks. These obligations reached decisions made before a sales contract: which fields to collect, how long to keep them, who could see them and whether a test environment needed a copy of live customer records.

Those choices have economic consequences. Every unnecessary copy creates another place to secure, search and eventually delete information. A product with clear boundaries between customers, documented retention settings and usable access controls gives its operator a smaller administrative burden. The advantage depends on the actual product and customer requirements; a compliance label on its own says little about deployment effort or operating cost.

Article 3 covered processing in the context of an EU establishment and, in specified circumstances, organisations outside the EU offering goods or services to people in the Union or monitoring their behaviour there. A supplier's headquarters therefore did not settle the question of whether the regulation applied. International expansion required a closer examination of customers, users and the processing involved.

There was also no universal requirement to obtain consent for every use of personal data. Article 6 provided several lawful bases, with conditions attached. Treating consent as a standard answer could obscure the actual relationship with the individual. Investors examining a business built on personal data needed to understand the lawful basis for its principal activities and whether the proposed expansion changed the uses of information customers had originally supplied.

The most useful commercial question was how much work each new customer added. Could the company answer a supplier review from maintained records? Could a customer administer permissions without an engineering ticket? Could the service return or delete information in the manner its contracts promised? These are observable capabilities with implications for sales capacity, service costs and customer confidence.

GDPR created substantial obligations and significant potential penalties, with the upper tier reaching €20 million or 4% of an undertaking's preceding worldwide annual turnover, whichever was higher. The enterprise opportunity lay in helping organisations perform the underlying work reliably. Privacy engineering, security operations and the management of software suppliers became increasingly connected parts of the same purchasing decision.