Choosing a software development partner in Germany: DSGVO, compliance and engineering culture

01DSGVO is an architecture constraint, not a checkbox

The GDPR - DSGVO in German law - shapes system design well before it becomes a legal review. Data minimisation means you justify each personal-data field you persist. Purpose limitation means a field collected for billing cannot be quietly reused for analytics. The right to erasure means deletion has to actually propagate through backups, logs, caches and downstream analytics stores, which is an engineering problem most teams underestimate badly.

Any partner who treats this as paperwork to be signed at the end will build you a system that cannot comply without a rewrite. The right time to design for erasure and data residency is the first schema review.

• Data minimisation: justify every personal-data field you store.
• Purpose limitation: collected-for-billing is not available-for-analytics.
• Erasure that propagates to backups, logs, caches and analytics.
• Documented lawful basis for each processing activity.
• Data residency: know which region every store and third-party service sits in.

02The AVV and sub-processor chain

Any external development partner touching production personal data is a processor under Article 28, which requires a written Auftragsverarbeitungsvertrag (AVV). This is not optional and not a formality - it must name the categories of data, the purposes, the security measures, and every sub-processor in the chain.

The sub-processor question catches people out. Your partner's cloud provider, error-tracking service, log aggregator and CI provider may all process personal data. Each needs to be disclosed and, where outside the EU, covered by an appropriate transfer mechanism. Ask for the full list up front; a partner who cannot produce one has not thought about it.

03Works councils and the co-determination question

If the software monitors employee behaviour or performance in any way - and time tracking, ticket throughput dashboards and access logging all potentially qualify - the Betriebsrat has co-determination rights under the Betriebsverfassungsgesetz. This is a genuine statutory power, not a courtesy consultation.

Practically, this means involving the works council early and designing with their concerns in mind: aggregate rather than individual metrics where possible, transparent data retention, and no covert monitoring. Retrofitting these decisions after a works council objection is far more expensive than accommodating them in the first design review.

04Engineering culture: what German technical teams actually assess

In our experience the technical evaluation weights differently than in US procurement. Demos matter less. Architecture documentation, test coverage, error handling and operational runbooks matter considerably more. A partner who presents a polished prototype but cannot explain their failure modes will lose to one who presents a plainer system with a rigorous design document.

This is a reasonable bias. It selects for systems that survive year three, which is when the total cost of a shortcut becomes visible.

• Written architecture decision records, not just diagrams.
• Explicit error handling and documented failure modes.
• Test coverage as a standard practice, not a line item.
• Operational runbooks and on-call procedures before go-live.
• Documentation in a form the internal team can maintain after handover.

05Practical evaluation checklist

Before signing, get written answers to the following. A capable partner answers these quickly because they have answered them before.

• Which legal entity signs the AVV, and can we see the standard template?
• Full sub-processor list, including cloud, monitoring, CI and support tooling.
• Where does personal data physically reside, and can it be pinned to EU regions?
• How is a deletion request executed technically, end to end, including backups?
• Who has production access, how is it granted, and how is it logged?
• What happens to source code, credentials and data at contract termination?