Data protection is not a box to tick at the end. For apps used in Germany and the EU, the GDPR (DSGVO) and the German TTDSG shape decisions from the very first concept. Building it in early is cheaper and creates trust with users.
Note: this article gives practical guidance, not legal advice. For your specific case, involve your data protection officer or lawyer.
1. Data minimisation
Collect only what you need for the purpose. Ask yourself for every field: why do we need it? Date of birth, exact location or contacts are often not necessary at all.
2. Legal basis and consent
Every processing needs a legal basis – contract fulfilment, legal obligation, legitimate interest or consent. Access to device information for tracking, analytics or advertising generally needs prior opt-in consent. Implement a consent screen that is as easy to decline as to accept.
3. Privacy-friendly analytics
Choose analytics tools that can run without personal identifiers or only after consent, with IP shortening and EU data storage. Avoid sending data to third parties that you cannot explain in your privacy policy.
4. EU hosting and processors
Host backends and databases in the EU, ideally in Germany. Every service provider that processes personal data on your behalf (hosting, email, push services, crash reporting) needs a data processing agreement (DPA/AVV). Check international transfers carefully.
5. Security by design
- Encryption in transit (TLS) and at rest
- Secure storage of tokens (Android Keystore, iOS Keychain)
- Strong authentication, optionally biometrics and 2FA
- Role-based access in the admin panel
- Regular dependency updates and security tests
6. User rights inside the app
Users can request access, correction, deletion and data portability. Make it easy: profile editing, data export and account deletion directly in the app – the stores require deletion anyway.
7. Transparency
- A clear privacy policy linked in the app and the store listings
- Permission prompts with honest explanations
- Store privacy declarations (Google Data safety, Apple privacy labels) that match reality
8. Special categories
Health data, biometric data or data about children need extra protection, often a data protection impact assessment (DPIA) and stricter technical measures.
How we work
We document data flows during the technical concept, choose EU-hosted services, prepare the technical parts of your records of processing and coordinate with your legal advisor. The result is an app that is compliant and still pleasant to use.