# Mastercard Developers and GDPR
source: https://developer.mastercard.com/blog/mastercard-developers-and-gdpr/index.md

Authors: Ed Kilbane. What is the GDPR? In spring 2016, a new legal framework for collecting and processing personal data was adopted in the EU -- the General Data Protection Regulation (GDPR) -- which is enforce since May 25th 2018. The GDPR replaces the EU Data Protection law and strengthens controls that individuals have over their data and their right to privacy. Also, the GDPR applies to all companies that process the personal data of people living in the EU, not just those companies that are located in the EU. Selecting the following link will bring you to the EU GDPR portal if you wish to learn more about the framework. Why is the GDPR great for the individual? The very recent past has given the world major technology disruptions - smartphones, streaming, social networks etc. that have transformed and even eliminated entire industries whilst irreversibly impacting our daily lives. But has a piece of legislation ever come into effect with the potential to shift the balance of power from the digital entities behind these advancements to the needs of the individual? GDPR could very well be that game changer as it legislates to temper that insatiable desire for more and more personal data. If the date to choose the enforcement of GDPR was picked from the air, May 25th 2018 could not have been better timed. The reason I say this is the GDPR timeframe has coincided perfectly with the recent revelations regarding how a particular data analytics company questionably used data harvested from a social network to micro target individuals to influence their actions in the real world. The fallout from these exposures appear to have woken the world up from its largely catatonic attitude with regards to its data. This recent news has left many people feeling exposed, manipulated and that their data is just a commodity that can be bought and sold whereas they should feel their data is an expression of their identity and something they should be able to exert more control over. There is a feeling of helplessness as what individuals can do to protect their data, know how it's being used, who is using it, or how they can access it and even request it is removed, permanently. This is exactly what GDPR is designed to achieve; give individuals the rights to obtain the data a company has collected about them and also to have the right to be forgotten if they withdraw their consent for it to be held. How has Mastercard Developers become GDPR compliant? Mastercard Developers is just one of a broad number of Mastercard assets that has been brought into compliance. Actually, a new centralized GDPR enterprise platform has been created in Mastercard to streamline the effort that our developer platform now integrates with. For every developer who signs up, we persist the version of all legal content agreed to and the timestamp of that agreement. Legal content includes: Opt in/out of email communications text Agreements with Mastercard's Privacy Policy, Developer Program Agreement and Terms \& Conditions Agreements with the Masterpass Operating Rules for developers on-boarding as Masterpass Merchants All Mastercard Developers legal content is now centralized Developers who want to view, update, port or delete their data will be able to access Mastercard's GDPR portals to do this On Mastercard Developers, we invest a lot of energy and focus in getting the end user experience right and a particular design decision to keep the sign up process as light as possible has really stood in our favour with regards to GDPR; at sign up, we ask the bare minimum of username, email address and password to get going. We only ask for more detail as it is required, usually when a developer requires production access on our services. Undoubtedly, GDPR compliance requires work but we see it as a positive step forward - the protection of personal data and the rights of the individual helps build a stronger data protection foundation that benefits all. Also, in Mastercard's overall preparations for the GDPR, we realized that we needed additional safeguards for our data analytics. That resulted in a new idea, and, earlier this year, we co-founded a new company called Trūata with IBM. As an independent data trust, Trūata anonymizes data and conducts data analytics in full compliance with the GDPR. Please note this blog is for informational purposes only and is not legal advice.