Building software that survives an audit: GDPR by design, data residency, access control, and the compliance questions Belgian clients actually get asked.
GDPR is not a document you produce at the end of a project. It is a set of decisions about where data lives, who can reach it and how long it is kept — decisions taken while the schema is being designed, and very expensive to revisit afterwards.
The writing here is about building software that survives being asked questions: data residency inside the EU, access control that reflects the org chart, audit trails that record who changed what, retention that actually deletes. Belgian clients in healthcare, finance and the public sector ask these questions during procurement, and a supplier without answers is filtered out before the demo.
Also covered: the EU AI Act as it applies to ordinary business automation, and the difference between practices aligned to a standard and certification against it — a distinction worth keeping honest in your own marketing.
