I'm a Software Engineer, and I've just taken my first "side gig" job in hopes of becoming Freelance one day. I'm based in the UK. My Client told me exactly what they want, and i've built it. However, I am now growing concerned about the accountability I have under the GDPR. I believe my Client is unaware of how strict GDPR is (personally I was until I started my research today).

So, it seams that to be GDPR compliant, i'd need to add several features to the software. The problem is, these are of course features the Client has not asked me for. I will highlight it to them, but if they say no (As, it might sound like me just asking to write more code for more money), what can I do? If I am liable, then I'm let with no choice but to cancel the job.

The software is a CRM for B2B email and telephone marketing, but it holds the information of persons who work at the target businesses. I have an "unsubscribe" feature for the emails, but that's all.

I hope someone can help, or point me towards it. Thanks

  • 2
    Are you hosting the software for the client or just developing it? Will the client be responsible for their own hosting and running of the software after you deliver it?
    – user28517
    Jun 27, 2020 at 10:28
  • Did your contract with the client include any commitments as to the compliance of your work product with legal or regulatory requirements?
    – phoog
    Jun 28, 2020 at 17:19
  • @phoog No contractual commitments to compliance, purely features.
    – Matthew
    Jun 28, 2020 at 18:31
  • @Moo I am hosting it on my shared hosting, where I host my own website. He will pay me to keep the website running.
    – Matthew
    Jun 28, 2020 at 18:32

1 Answer 1


On the facts you've given us, you have obligations and potential liability as a processor of the data

You're responsible for the security of the data in the database, maintaining records, appointing a data protection officer if necessary, and so on.

You can be held liable for any breaches by the ICO or other relevant regulatory authority, and an injured party might bring an Article 82 claim against you if you failed to comply with GDPR provisions specifically relating to processors or you acted without the controller’s lawful instructions or against those instructions.

The Information Commissioner's Office have a helpful guide to processor liabilities in a contract which I strongly recommend reading. There is a more detailed guide on the liabilility of processors under the GDPR generally which I also strongly recommend reading.

These two guides should hopefully address your concerns.

  • 1
    Its worth emphasising that this liability stems from hosting the data rather than having written the software. Aug 14, 2020 at 16:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .