Application Lifecycle Security (A. 14 Systems acquisition, development and maintenance) During the development lifecycle best practices, state of the art and well-acknowledged secure development practices, frameworks or standards should be followed meaning that the data processor must implement Data Protection by Design- and by Default principles in all phases of the data processing and system life-cycle. This includes that only relevant, proportional and necessary information including use, disclosure, retention, transmission and disposal on indi- viduals are collected for the application processing the data. Personal data must not be used in the development or test environments without being anon- ymised, pseudonymised, scrambled or masked before use. System development must take place in specialised development environments isolated from production and test systems and must be protected from unauthorised access. Source code must be protected against unauthorised access and use. The data processor must perform security reviews, vulnerability checks and penetration tests of all code and applications developed for the data controller before release. Periodic PEN tests should be performed and documented on web-facing applications.
