How we can assure that our Web & mobile application Is GDPR Complaint

Mark Tabor

Is there anyone who is have great knowledge for data security and who knows data protection act as well. With respect to the web and mobile what are the basic contraints we should keep in mind to have a GDPR complaint site and apps.

What should be the application architecture for web if we consider .NET MVC as technology stack and html css js as frontend. If we use API what would be the standards for API to use .

Thanks in advance.

7 Replies

Know the answer? Post it — somebody with the same question will find it here.

Sachin Singh5y ago
A solution can be send a genuine link and a hidden link or hidden input with unique value as we do in antiforgery token, and check if the request is from same user, so even if he manipulates date, he would not be qualify for other criteria.
+1
Mark Tabor5y ago
The link user normally copies and paste into the browser and than edit, I think lot of appliction are using Link sending method but i do not know if someone is sending date parameter as query string with it or not .
+1
Sachin Singh5y ago
That i am too finding till date, if anyone sends links to email, it would be clickable otherwise what is the purpose of including link? We can just put address without anchor tag. The propar solution would be , link should be clickable but not modifiable.
+1
Mark Tabor5y ago
Thanks Scahin , I respect your answer, a very thoughtful concept, but still this topic is quite thought provoking , Even if we are using Cloud then STILL GDPR IS not GRANTED we need to do it , For example if you are using OAUTH or so , If you are using API's then token based authentication on API's , IF you Want the Adminstration Roles than Bind Admin URL TO specific IP's (Static IP)
IF you are using any third party services Then Must include their separate Privacy policy as well, GDPR is about 122 Pager Document , Its not only deals with Cross site scripting Attacks, input validation ,SQL injections but lot more.
A solution Architect role can respond to all these things .
Thanks for your response and reply . I am still looking to hide URL from Status in email :)
+1
Sachin Singh5y ago
sir
its all about data, what an architecture can do in this, if you are using cloud and microservices , the chances are you already have a good secure architecture.
if you have a typical n-tier (UI-->API->BLL-->DAL-->BO) architecture , then also as a developer for security you just need to focus on where you are storing user information and how do you take it from user.
If you take inputs properly that can not be manipulated in any way and you store it sincearly like only valid user (Authorize user) can edit or modify their detail then you are already playing in safe zone.
https is like understood term, who wants to send data withot encryption , so i dint talk about this.
yes a proper Privacy Policy is must to have , don't use privacy policy generator in hurry, higher a writer or write yourself only what you do with the user data, how you manage cookies, how they can edit infos,do other parties like adsence use their own cookies etc.
if you ask user to subscribe then ensure that you don't sell emails and do include it in privacy policy.
or what you can do more?
+1
Mark Tabor5y ago
Thanks Sachin for your response, btu the detail response is quite tough and it handles lot of things with respect to GDRP , CSRF is one minor thing there are tons of other things which we need to take care off.
Like Cookie and privacy policy
Deletion of data if not in used
https rather than http
SSL
lot more...

thanks for your suggestion , My question is not just listing of GDRP contraints but it ask what is the best project architecture we can use for it using .NET MVC.
+1
Sachin Singh5y ago
If you ask user for personal details anywhere in your application , then it becomes manidotry to keep them as secret , and any data leak may put you in danger.
make sure any input that you take via forms are not CSRF vulanarable, you have proper authorization and there is no chance of data leak or hack of your site.
+1