GDPR and LGPD engineering: we build the technical measures, your counsel reads the law

GDPR Article 25(1) and (2): appropriate measures when the means of processing are determined and during processing, and by default only the personal data necessary for each purpose, in the amount collected, the extent of processing, the storage period and who can access it. LGPD Article 46 §2: the security measures apply from the conception of the product or service through its execution.

GDPR Article 32(1): pseudonymisation and encryption, the ability to ensure confidentiality, integrity, availability and resilience, timely restoration after an incident, and regular testing. LGPD Articles 46 and 47: technical and administrative measures against unauthorized access and against accidental or unlawful destruction, loss, alteration or communication, which keep applying after the processing ends. Article 49: systems structured to meet the security requirements.

GDPR Article 33: the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours; the processor tells the controller without undue delay; every breach is documented. LGPD Article 48: the controller communicates to the national authority and to the data subject an incident that may cause relevant risk or damage, within a reasonable period the authority defines, describing the data affected, the people involved, the technical measures used, the risks and the measures taken. When the severity is judged, technical measures that made the data unintelligible to unauthorized third parties are taken into account (§3).

GDPR Article 30 requires records of processing activities and Article 35 a data protection impact assessment where the processing is likely to result in a high risk. LGPD Article 37 requires the controller and the operator to keep a record of their processing operations, and Article 38 lets the national authority require an impact report.

The engineering: a data inventory per feature, retention that deletes on a schedule instead of keeping data forever, masking of fields that most people do not need to see, and defaults that expose nothing to an unbounded audience (GDPR Article 25(2)). The legal basis for each purpose is your counsel's call.

No fixed package builds deletion and retention on its own. We scope it in Discovery or with engineers by the hour.

GDPR Article 32(1)(a) names pseudonymisation and encryption, and LGPD Articles 46, 47 and 49 ask for technical measures against unauthorized access. The engineering: TLS in transit, managed keys and encryption at rest, private network paths to data stores, access through your SSO with MFA and least privilege, and secrets in a managed store.

No fixed package covers encryption and access control on their own. We scope them in Discovery or with engineers by the hour.

GDPR Article 32(1)(b) and (c) ask for ongoing resilience of processing systems and the ability to restore availability and access in a timely manner. The engineering: encrypted, scheduled backups, restore drills and a rehearsed rollback.

No fixed package covers backups and recovery on their own. We scope them in Discovery or with engineers by the hour.

GDPR Article 32(1)(d) asks for a process for regularly testing, assessing and evaluating the effectiveness of the measures. The engineering: dependency, secret and container scans on every change with suppressions that expire, automated tests in the pipeline, and gates that stop a release.

GDPR Article 33(3) and LGPD Article 48 §1 list what a notice must describe: the data affected, the people involved, the likely consequences and the measures taken. That depends on records that survive an incident. The engineering: logs and alerts that show who touched what, designed so that personal data does not land in log lines, and a runbook that follows the content the notice needs.

GDPR Article 30 and LGPD Article 37 expect a record of processing. The engineering: a data-flow map kept next to the code and generated from the infrastructure definitions, so the record matches what actually runs. The purposes, the legal basis and the impact assessment's judgment are yours.

A 2-week build or re-architecture of your CI/CD pipelines and your infrastructure as code. The gates that go into the pipeline, such as a vulnerability scan, are agreed in the SOW.

Metrics, logs and traces wired, 3 SLOs defined, alerts tested until they fire, and a runbook.

A Playwright suite for your 5 critical flows, running in your CI, with accessibility checks.

Discovery understands your product and its configuration end to end and delivers a roadmap with a backlog, roles, critical changes and needs. Bring your record of processing, your counsel's list or a customer's privacy questionnaire, and we turn it into engineering work.

For the work that continues after a package: Senior USD 45–⁠50 an hour, Lead or Architect USD 55–⁠60, with a 6-month minimum, billed per hour worked. You interview the engineer who will do the work.

• How staff augmentation works
• Security and procurement