GDPR creates recurring engineering work for a VP of engineering: answer data subject requests within one month, delete data across every store, control transfers outside the EU, and track subprocessors. These are backlog items with deadlines. Plan capacity for them the way you plan for on call.
What deadlines does GDPR put on engineering?
Article 12 requires the controller to act on requests under Articles 15 to 22 without undue delay and in any event within one month of receipt, with a possible extension that must be communicated with reasons. Those articles cover access, rectification, erasure, restriction, portability and objection. Each request touches every system that holds the person's data.
Constructed example: a user asks for deletion. Their data sits in the primary database, a search index, a warehouse, a log pipeline, a support tool, a backup set and an email platform. A script that deletes from the primary database and nothing else will pass a demo and fail the request. The fix is an inventory of stores with an owner and a deletion mechanism for each, plus a documented rule for backups.
How should you build for deletion?
Pick an identifier that exists in every store. Make deletion an event that fans out, not a manual checklist. Record that the request was processed without keeping the data you just deleted. Decide in writing how backups age out and how restored data is re-deleted. Article 17 allows exceptions, so legal should confirm which apply before the engineers hard code them.
What about subprocessors?
Article 28 says a processor may not engage another processor without prior written authorisation of the controller, specific or general, and must inform the controller of intended changes under a general authorisation so the controller can object. For engineering that means a gate in procurement and in code review: new SaaS or new AI API calls that carry personal data need a contract and a register entry before they ship.
Where do transfers come in?
Chapter V, Articles 44 to 49, governs transfers of personal data to third countries or international organisations. Violations sit in the higher fine tier of Article 83. Engineering's part is knowing where data physically goes: regions of managed services, support access from other countries, log shipping, and the locations of subprocessors. Legal chooses the transfer mechanism, but they cannot choose one without your map.
When is a DPIA triggered?
Article 35 requires an assessment before processing likely to result in high risk and names large scale special category data, systematic profiling with significant effects, and large scale monitoring of public areas as examples. Product launches that introduce automated decisions about people should include the question in the planning template.
What does non-compliance cost?
Article 83 allows fines up to 20 million euros or 4 percent of worldwide annual turnover for transfer and data subject rights infringements, whichever is higher. Obligations on controllers and processors under Articles 25 to 39 carry up to 10 million euros or 2 percent. Treat both as ceilings and expect authorities to weigh the facts.
What to do
- List every data store with personal data, with an owner and a deletion method.
- Build one internal service that fans out access and deletion requests and logs completion.
- Set an internal target well inside the one month window, so extensions are rare.
- Add a vendor and region gate to design review.
- Keep a map of regions, support access paths and subprocessors for the transfer discussion.
- Add the DPIA question to your launch checklist.
Quick check
How long do we have to answer an access request?
Article 12 says without undue delay and in any event within one month of receipt, with an extension possible if the controller informs the person with reasons.
Must backups be deleted immediately on an erasure request?
The text does not give backup specific rules. Decide with counsel how backups age out and document it, and make sure restored data is not reintroduced.
Sources
Last reviewed: 18 October 2026.
