Apprehension around the General Data Protection Regulation (GDPR) has been focused on the best practice for handling data, but companies cannot afford to overlook how personal data is processed by software applications.