Process SDLC-GDPR: Towards the Development of Secure and Compliant Applications

With the full application of the General Data Protection Regulation (GDPR) in the EU on 25 May 2018, data protection by design and by default become a legal obligation. The GDPR requires organizations to adapt how they handle and protect personal and sensitive data. Explicit consent for data collection and processing, report security problems affecting personal data and the appointment of a data controller (DPO) has become mandatory and is already being complied with. However, issues like security by default and by design, from a practical perspective, are still taking the first steps. In this paper we propose a process to support the software development with the essential requirements for obtaining protection and privacy in personal data. The encompasses six procedures, aligned with the SDLC cycle. Each procedure is composed of activities and reference documents. By adopting a process like we propose, organizations achieve greater compliance between the software and the GDPR, contributing to the personal data protection, as well as, the reduction of potential fines and protection against possible financial and trust/reputation losses.