GDPR Chapter II as it affects systems: the Article 5 principles, the lawful bases in Article 6, conditions for consent and the special categories of data that need extra protection.
The six processing principles in Article 5(1) and how they translate into system design: defined purposes, data minimization in schemas and logs, accuracy controls, retention and security. Overview page for the principle-specific pages that follow.
Keeping personal data in identifiable form no longer than the purpose requires: retention schedules, deletion jobs, backup and log retention, and the evidence that retention rules are actually enforced in systems.
The security principle: protecting personal data against unauthorized or unlawful processing and accidental loss, destruction or damage. Explains how it links to the detailed Article 32 obligations and to the breach definition.
The controller's duty to be responsible for, and able to demonstrate, compliance with the principles: which documents, records and evidence make compliance demonstrable, and how accountability connects to Article 24.
The six lawful bases and why systems should record the basis for each processing purpose: the basis decides which rights apply, such as portability and objection, and whether consent must be captured and evidenced.
What consent-based processing requires from systems: demonstrable consent records, separate plain-language requests, withdrawal as easy as giving consent, and no bundling of consent with access to a service.
The prohibition on processing health, biometric, genetic and other sensitive data unless an Article 9(2) exception applies, and the knock-on effects on DPIAs, DPO designation, records of processing and automated decisions.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.