In today’s mobile app landscape, providing customers with the most tailored and personal experience possible is essential to edging out competitors. But creating such a custom-made experience requires collecting personal data – and when considering the criticism massive tech companies are garnering for their misuse of sensitive information – mobile app developers must prioritize data privacy and compliance.
Furthermore, the consequences of data breaches – including financial losses, operational downtime and reputational damage – continue to grow in severity. Financial damages (as fines) are potentially heavy burdens. And while a damaged reputation cannot be measured exactly, the possibility of losing customers due to suboptimal data security could result in the company’s ruin.
A user’s personal data can be anything from their user name and email address to their telephone name and physical address. Less obvious forms of sensitive data include IP addresses, log data and any information gathered through cookies, as well as users’ biometric data.
Any business whose mobile app collects personal information from users is required to have a Privacy Policy. Regardless of app geography or business domain, there are mandatory regulations such as the GDPR, the CCPA, and the PDPA, as well as Apple, Google and Android guidelines that ensure accountability and user data privacy. Some apps do not directly collect personal data but instead use a third-party tool like Google Analytics – they, too, need a Privacy Policy.
Data privacy and security and the mobile app creation process
The mobile app creation process begins by identifying a problem and determining how to fill that need. App developers will then decide on the look, feel and design of the app, and will establish a continuous feedback loop for consistent consumer recommendations. Although this is a truncated look at an app’s development, data privacy and compliance must be strategically intertwined from the very beginning of the mobile app creation process, as it is central to its success and longevity.
This theme is our view of Continues Compliance that we believe is now a requirement for all organizational operations. Throughout the mobile app construction and development cycle, businesses must treat personally identifiable information (PII) with the highest level of discretion.
Additionally, part of the overall development strategy must include properly communicating mobile app compliance to users. Employee handbooks (for B2E app), service terms and conditions and privacy policy (for B2C apps) are all established means of explaining user rights to customers. This material should allow users to easily understand what personal data is collected, why it is collected, where it gets transferred and how it is collected. Likewise, apps must inform their users if any third parties are involved.
Another key aspect of mobile creation is understanding that privacy and security compliance is dynamic and ever-evolving. More user information will most likely need to be collected as new features get added. The app must be designed to react to regulation changes, nullified user consent, erased data, or revoked permission – all while keeping the user experience consistent.
Additional considerations
Readily accessible information: Not only will compliant apps clearly explain to users how their data gets handled, but an app must also make those explanations easily accessible. The user needs to have the ability to access the app metadata on the marketplace as well as any explanations as to why the app can get into their device’s advertising identifier (iOS IFDA, Android AAID). An app will likewise need to provide customers with permission requests whenever the app attempts to track a user’s location or gather analytics.
Shared responsibility: Ensuring data privacy and compliance doesn’t only fall on the shoulders of the app developers – rather, it is a shared responsibility of all involved parties. Every entity that handles a user’s sensitive data needs to pass a formal security test and acquire the necessary authorization.
Guaranteed user rights: For apps that lawfully use personal data in advertisements and other interests must ensure that users are aware of their rights, such as the right to opt-out or unsubscribe, the right to opt-in when transferring data between parties, and the right to review or erase collected data.
Commitment to accuracy: Apps will need to incorporate iOS Human Interface Guidelines plus Google Material Design notation. Also, an app should be flexible enough to respond quickly to user requests for data correction and rectification.
Compliance as a code: Designing based on regulatory requirement is a legal requirement under the GDPR. When you start creating your mobile app, you should be considering your users’ privacy. As per GDPR Article 23, your app must only hold and process user data that is absolutely necessary.
China’s new Personal Information Protection Law (PIPL) puts the responsibility of proving that everything was done right on the company, not the government.
Besides the obvious benefits of being compliant with legislation around the world and app store requirements, having a privacy policy and security assurance fosters transparency between app creators and customers – boosting reputation and trust.
Moreover, integrating data privacy and compliance throughout the mobile app creation process saves developers the headache of backtracking or haphazardly adding privacy and security features once the app is already complete or far along in development.
Contributing author: Boris Khazin, Director, Governance, Risk & Compliance, EPAM Systems
"creation" - Google News
September 13, 2021 at 12:30PM
https://ift.tt/3hrF8jN
Mobile app creation: Why data privacy and compliance should be at the forefront - Help Net Security
"creation" - Google News
https://ift.tt/39MUE4f
https://ift.tt/3bZVhYX
Bagikan Berita Ini
0 Response to "Mobile app creation: Why data privacy and compliance should be at the forefront - Help Net Security"
Post a Comment