Two ways to meet the GDPR
There are two moments a business meets the GDPR: at design time, or when the letter arrives. The second meeting is the expensive one. I have built GDPR-compliant systems for a decade - this is the builder's view of why the first meeting is cheap and the second is not.
Designed-in looks like this
- Data minimisation as a feature. Every field you do not collect is a field you cannot leak, do not have to secure, and never have to explain. The contact form on this site asks for exactly what a reply needs - nothing else.
- A retention decision, not a retention accident. "We keep enquiries until the conversation ends or deletion is requested" is one sentence. Most companies instead keep everything forever because nobody decided anything.
- Measurement without surveillance. First-party, cookieless analytics with a daily-rotating pseudonymous id answers every business question I have ever needed - which pages work, where visitors come from, what converts - with no banner, because there is nothing to consent to.
- A written answer to "what does the model see". The AI-era addition: when an agent touches personal data, the flow is documented before launch - what goes in, what is stored, what the vendor sees, where processing happens.
Bolted-on looks like this
A consent banner with 400 "partners". A privacy policy copied from a template that describes someone else's site. Cookies nobody can list. And, at the worst possible moment, an engineer spending a week answering "where exactly do we keep personal data?" because the honest answer is "everywhere".
The commercial upside nobody mentions
Compliance designed in is a sales asset. Corporate clients now send vendor questionnaires before signing anything - and the vendor who answers in an afternoon, with documentation, beats the one who goes quiet for three weeks. I have watched that difference decide deals.
If your privacy setup is a banner you bought in 2019 and hope, a one-call review will tell you what is actually urgent - it is usually less than you fear, and more specific.