If your app has customers or users in the UK or the European Union, data protection law applies to you however small you are. That sounds daunting, but most of what is expected of a young product comes down to a handful of habits that are far cheaper to build in at the start than to add later.

This guide covers eight things to settle before launch. It is general information and not legal advice, so check your own position with a qualified adviser, especially if you handle sensitive data.

The 8 things

1. Know what personal data you collect and why

Make a simple list: what you collect, where it comes from, why you need it and who sees it. This is the foundation for everything else, and it forces a useful question: do we really need this field?

2. Have a lawful basis for each use

The law requires a valid reason for processing personal data, such as a contract with the user, a legal obligation, legitimate interests or consent. Decide which applies to each purpose and record it.

3. Write a clear privacy notice

Tell users in plain language what you collect, why, how long you keep it, who it is shared with and how to exercise their rights. Link it where data is collected, such as on signup.

4. Make rights requests possible

Users can ask to see their data, correct it, delete it or receive a copy, and you generally must respond within set time limits. Design the app so that finding, exporting and deleting a person’s data is practical, not a manual hunt.

5. Control access and secure the data

Only the people who need data should see it, and it should be protected appropriately. In Bubble, that means thoughtful roles and privacy rules. See our security guide.

6. Know your processors and where data goes

Hosting, email, payments and AI services all handle data on your behalf. Keep a list, check their terms, make sure appropriate agreements are in place, and understand whether data is transferred outside the UK or EU and what safeguards apply.

7. Decide retention and deletion

Do not keep personal data forever. Set sensible periods for each type, and build deletion or anonymisation into the system so that it happens reliably.

8. Prepare for a breach

Many breaches must be reported to the regulator within a short deadline, and sometimes to affected people. Write a one-page plan: who decides, who contacts whom and what gets recorded.

Also check

• Whether you need to register with your national data protection authority or pay a fee. In the UK, many organisations that handle personal data must pay a data protection fee to the ICO unless exempt.
• Cookie and tracking consent on your website and app, which is governed by separate rules.
• Extra care with children’s data and with special category data such as health information.

How this shapes the build

These requirements belong in your PRD so they are designed in rather than patched on. Our Discovery Sprint covers them as part of the data model and workflow design: $345, delivered within 24 hours and credited toward the build. See also database design mistakes for why structure matters.

Frequently asked questions

Does GDPR apply if my company is outside the UK or EU?

It can, if you offer services to people in the UK or EU or monitor their behaviour. Take advice on your situation.

Do I need a data protection officer?

Only in certain circumstances, such as large-scale processing of sensitive data. Check with an adviser.

Is it expensive to comply?

Most of the cost is in thinking clearly early on. Designing for it at the start is usually far cheaper than rebuilding later.

Can you build it so users can delete their own data?

Yes. Self-service export and deletion can be part of the build and are best planned from the start.