PIPELINEGuide
API integrations and data protection: what GDPR requires
As soon as personal data is processed through API integrations, clear obligations apply. What these are specifically, what is almost always missing in practice, and what actually suffices.
As soon as personal data is processed through API integrations, you need a legal basis, purpose limitation, defined deletion periods, information for data subjects, and a data processing agreement with every service provider involved. In practice, the same three points are almost always missing: the deletion period, the notice at the point of collection, and clarification of whether the provider uses the data for its own training.
01 — Data Protection
What GDPR requires
As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.
In practice, this means for API integrations: a data processing agreement with every service provider involved, checking where processing takes place, a documented deletion period, and an understandable section in the privacy policy. Three things are almost always missing in practice: the defined deletion period, the notice at the point where data is collected, and clarification of whether the provider uses the data for its own training.
A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.
02 — Contract
What needs to be clarified in writing
- Ownership of data and access. They belong to the client. If a provider won't clearly confirm this, that's the most important information from the conversation.
- Handover upon termination. In what format, within what timeframe, at what cost.
- No minimum term without consideration. Lock-in is justifiable if something is delivered in return — otherwise not.
- What a later change costs. The total cost isn't determined by the project price, but by the hourly rate in year three.
- Documentation as a deliverable. Not as a promise, but as a line item in the proposal.
03 — Risks
What can go wrong
- The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
- The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
- No one maintains it. The biggest risk of all — and the most easily avoidable.
- Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
- Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.
04 — Questions
Frequently asked questions
Who maintains it later?
You receive code and documentation. We deliberately build with widely used technologies so that switching is possible.
Is an interface more secure than a manual export?
Significantly, because human errors during export and import are eliminated and every exchange is logged. A manual export leaves no trace if something was overlooked.
Can multiple systems be connected simultaneously?
Yes, that's actually the more common case — for example, shop, inventory management, and accounting together. Each connection is planned and tested individually, even if everything works together in the end.
What happens during an outage?
The connection remembers what hasn't been transferred yet, tries again, and reports after multiple failed attempts. Data isn't lost, it arrives delayed.
How often is data synchronized?
From immediately to nightly — depending on what's technically necessary. Immediate synchronization isn't always better: for systems with post-processing, a nightly run is often the more stable choice.
What if our legacy system has no interface?
Then there are usually workarounds: database access, automated file exchange, in exceptional cases surface automation. All are more fragile than a real interface. We'll honestly tell you how stable such a solution will be before you decide.
What does maintenance cost during operation?
As long as none of the connected systems changes fundamentally, ongoing effort is low — monitoring reports itself when something doesn't fit.
05 — Next
Related pages
- API Interfaces — Overview
- API Interfaces — Pros and Cons
- API Interfaces — Practical Examples
- API Interfaces — Alternatives
- API Interfaces — Process
- API Interfaces — Contract and Ownership
- API integrations — ongoing operation
- API Interfaces — Provider Comparison
- Process automation
- Custom software
- CRM integration
- All guides
Next step
We'll look at your starting position.
Tell us what's eating up time today. That becomes an assessment with effort and benefit — and only then an offer.