UK GDPR Software Guide for Developers (2026)

DPO requirement under UK GDPR: a DPO must be appointed if: (1) public authority or body, (2) large-scale systematic monitoring of individuals, (3) large-scale processing of special category data. For most UK software companies: (a) B2B SaaS (processing employee data of clients -- B2B -- no DPO required unless large scale), (b) NHS HealthTech (processing patient health data at scale -- DPO typically required), (c) FCA FinTech (processing financial behaviour data at scale -- borderline -- ICO guidance suggests DPO recommended for systematic financial profiling), (d) consumer app with location tracking (systematic monitoring of individuals -- DPO likely required). ICO guidance: even if not legally required, a DPO or equivalent privacy lead is good practice. ClickMasters: all NHS and FinTech clients advised to appoint DPO or privacy lead. GBP5,000-GBP15,000/year for external DPO service.

UK GDPR right to erasure (Article 17) in PostgreSQL: (1) CASCADE DELETE (set up foreign key constraints with ON DELETE CASCADE -- deleting the primary user record cascades to all related tables), (2) soft delete consideration (GDPR erasure is not soft delete -- anonymise or hard delete), (3) audit log retention (GDPR allows retaining anonymised audit logs even after erasure -- replace personal identifiers with anonymised reference), (4) backup retention (personal data in backups must also be erased within 30 days -- AWS Backup retention policy), (5) third-party processors (notify all processors of erasure -- they must also delete). ClickMasters erasure pattern: PostgreSQL CASCADE + audit trail (anonymised) + TanStack Query cache invalidation + third-party processor notification (Stripe delete customer, Onfido delete identity verification) + backup TTL (30 days). Erasure confirmation: automated email to data subject confirming erasure with reference number.