The client showed us an out-of-the-box system that had been developed for them over three years by an outsourcing company. The code was written in PHP and based on not GDPR compliant architecture. An Independent GDPR Security Consultant recommended that our client redo the architecture and use not PHP, but only Java or .NET.
Using our GDPR checklist, we compiled the Software Architecture Document for a review by the same consultant. They approved our proposal for GDPR-ready system architecture and we started the development process.
Our Senior Java programmers started converting the PHP code to Java. In fact, it was backend development from scratch. We used the Spring Security framework to reduce development time while maintaining a high level of security: this is a powerful and highly customizable tool that provides the significant number of premade solutions for authentication, privileges management and encryption.
Given that the UI of the system was written in Reactjs and that we have Reactjs developers in our team, we did not rewrite Reactjs but modified it to meet new requirements. This allowed our client not to overpay. In addition, we appreciate that React.js supports quick writing of automated tests, which increases the security level.
On the client side, there was a Product Owner (PO), who had a thorough knowledge of system requirements, which allowed us to significantly reduce the development time.