A practical web application security checklist for growing businesses
Review account access, recovery procedures and server controls, then assign owners to recurring checks.
Read articleInventory personal information across applications, exports and backups before defining access and retention.
List the personal information your business keeps before changing its forms or tools. Customer details can exist in the main application, exports, email and backups at the same time. A retention rule must account for those copies.
This article covers system design, not a determination of your legal obligations. Check the applicable requirements with a qualified adviser and the relevant authority.
Morocco’s Law 09-08 concerns personal-data processing under CNDP oversight. Check which notification or authorisation procedure applies to your processing and review transfers abroad separately.
GDPR can apply outside the EU in specified circumstances, including offering goods or services to people in the EU or monitoring their behaviour there. Working with a European company alone does not determine all your obligations; contracts can introduce additional requirements.
For each system, record the purpose of the data, who can access it and the retention period you need to justify. Identify hosting, backups and suppliers that receive copies. Design a way to handle applicable access, correction and objection requests.
Suppose you remove a customer from your CRM. Check whether an export or support tool still retains their details. Decide how your retention policy handles those copies instead of assuming the CRM action covers everything.
Review emailed spreadsheets, test environments and marketing lists. Assess suppliers before sharing personal information and record who owns each review. Data minimisation and access controls support compliance work but do not establish compliance by themselves.
Start with the most sensitive systems, then keep the inventory current as uses and suppliers change. Our security service can help examine the technical scope.
Notification and GDPR guidance checked on 12 October 2026. Verify the current procedure for your situation before acting.
Review account access, recovery procedures and server controls, then assign owners to recurring checks.
Read articleTell us what you want to build, improve or automate. We will help you find a clear next step.