GDPR, with the record of processing kept current
Article 30 records, Article 32 security measures and the processor contracts behind them, kept against the same asset and vendor registers the rest of your program already uses. The ROPA stops being a spreadsheet one person owns and nobody else reads.
- An Article 30 register kept against real systems
- Article 32 measures inherited from ISO 27001 or SOC 2
- Processor contracts and subprocessor lists, tracked
- A 72-hour breach procedure with named owners
GDPR
Organization-wide · 2016/679 · 31 controls
GDPR coverage
- Enforced by
- National supervisory authorities
- Structure
- 99 articles, 11 chapters
- Demonstrated by
- Records, contracts, assessments
- Breach clock
- 72 hours to the authority
01
Adopt it, don't rebuild it
Article 32 measures map onto the controls you already run for ISO 27001 or SOC 2, so the security half is largely inherited. What is specific to GDPR (the register, the lawful bases, the transfers, the rights procedures) is what the program adds.
02
Evidence with a date on it
A ROPA that is accurate for one afternoon is worth nothing. Entries hang off the systems and vendors already in the register, and reviews expire on a cycle, so the record ages visibly instead of silently.
03
What the assessor leaves with
A supervisory authority, a customer's data protection officer or your own counsel gets a scoped, read-only view. Records, measures and the evidence behind them export together rather than being reassembled under deadline.
What you adopt
GDPR, in its own numbering
- Art. 5Principles and accountability
- Art. 6, 9Lawful basis
- Art. 12–23Data subject rights
- Art. 28Processors and subprocessors
- Art. 30Records of processing
- Art. 32Security of processing
- Art. 33, 34Breach notification
- Art. 35Impact assessments
- Ch. VInternational transfers
Ninety-nine articles, but this is where the operational weight lands — and where a supervisory authority starts.
What you show
What an assessor will ask to see
Record of processing activities
Article 30. Purposes, categories, recipients, transfers and retention. Per activity, and current.
Processor agreements
Article 28. A contract with every processor, a maintained subprocessor list, and authorisation for the ones they use.
Technical and organizational measures
Article 32. Encryption, access control, resilience, and regular testing of whether any of it works.
Breach procedure on a 72-hour clock
Articles 33 and 34. Detection, an assessment of risk to individuals, and a decision to notify that is recorded either way.
Data protection impact assessments
Article 35. Done before high-risk processing starts, not after somebody asks about it.
International transfers
Chapter V. Adequacy, standard contractual clauses, and the transfer impact assessments that go with them.
How it runs
Step 1
Adopt GDPR
Your organization gets its own copy of every control in GDPR, already mapped to the common controls you may satisfy for something else.
Step 2
Scope it
Organization-wide, or against a product, region or business line. Controls you scope out carry the reason you scoped them out.
Step 3
Collect the evidence
Connect a system or upload a document. Each piece is read, matched to the control it proves, dated, and given an expiry.
Step 4
Prove it
Invite your assessor to these frameworks and these dates, and nothing else. They leave with the Article 30 records, the measures, and the evidence for both.
The standard
What GDPR asks for
GDPR applies to anyone processing the personal data of people in the EU, wherever the processing physically happens. Ninety-nine articles across eleven chapters, enforced by national supervisory authorities, with fines reaching €20 million or 4% of worldwide annual turnover, whichever is higher.
Most of the operational weight lands in a handful of places: a record of processing activities under Article 30, appropriate technical and organizational measures under Article 32, processor contracts under Article 28, notification to the supervisory authority within 72 hours under Article 33, and a data protection impact assessment under Article 35 when the processing is high risk.
There is no GDPR certificate to show a buyer. What there is instead is Article 5(2), the accountability principle: you must be able to demonstrate compliance. In practice that means the records, the contracts, the assessments, and the dates that prove they were maintained rather than written once.
Questions
- Do we need a data protection officer?
- Article 37 requires one if you are a public authority, or if your core activities involve large-scale regular and systematic monitoring, or large-scale processing of special category data. Plenty of organizations appoint one anyway; the obligation is narrower than the practice.
- Is a signed DPA enough for a subprocessor?
- It is necessary and not sufficient. Article 28 requires the contract, and it also requires that you only use processors offering sufficient guarantees, which means assessing them, recording the assessment, and reassessing on a cycle. That is the same vendor due diligence the rest of the platform runs.
- How much of GDPR does ISO 27001 cover?
- The security half, largely. Article 32's measures map cleanly onto Annex A, so that evidence counts once and applies to both. What ISO 27001 does not give you is the register, the lawful bases, the rights procedures or the transfer mechanisms.
Provable today, not at audit time.
Run it yourself or have Bindsec run it for you. Either way, the evidence is current and the posture is one place.