GDPR compliance

The GDPR applies to every organization that processes personal data in the EU, and to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior there. It applies to controllers and to the processors that work for them.

  • General Data Protection Regulation
  • 2016/679
  • Requirements in the catalogue: 39
  • Official text

What it requires

The main obligations in plain words, with the article or clause they come from.

  • Art. 5

    Process personal data lawfully, for set purposes, no more than needed, accurately, no longer than needed and securely, and be able to show it.

  • Art. 15–22

    Answer the rights of data subjects: access, rectification, erasure, restriction, portability and objection.

  • Art. 28

    Use only processors that give sufficient guarantees, under a written contract.

  • Art. 30

    Keep a record of processing activities, as a controller and as a processor.

  • Art. 32

    Take technical and organizational security measures that fit the risk.

  • Art. 33–34

    Report a personal data breach to the supervisory authority within 72 hours, tell the people affected when the risk to them is high, and record every breach.

  • Art. 35

    Assess the impact on data protection before processing that is likely to result in a high risk.

How Atitic covers it

What the product does for this framework, on the same records as every other.

  • A record of processing activities, as controller and as processor, with purposes, legal bases, data categories, transfers, retention and a review date.

  • DPIAs, and a register of subject requests with the response date, extensions and identity checks.

  • A breach register under Art. 33(5): every breach is recorded, and the 72-hour deadline to the authority runs from when you became aware of it, with reminders to the owner.

  • The catalogue's requirements linked to your policies, evidence, vendors and records, and the gaps that remain.

  • Fasttrack marks the GDPR as applying from your answers: whether you handle personal data, where you are established and whether you process it for customers.

What the catalogue holds

The areas of the framework in Atitic and how many requirements each holds. When you adopt it, each requirement becomes a row you own and link to policies, evidence and controls.

  • Principles relating to processing of personal data7
  • Lawfulness of processing1
  • Records of processing activities2
  • Security of processing3
  • Special categories of personal data2
  • Information to be provided to data subjects2
  • Rights of the data subject8
  • Processor contracts and sub-processor management3
  • Personal data breach notification4
  • Data Protection Impact Assessment4
  • Data Protection Officer3

Common questions

Does the GDPR apply to a small company?

Yes, whatever its size. Organizations with fewer than 250 employees are spared the record of processing only where the processing is occasional, unlikely to result in a risk, and includes no special categories or criminal records data.

When must a breach be reported?

To the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people. When the risk to them is high, the people affected are told as well. Every breach is recorded, reported or not.

Is Atitic a processor of our data?

Yes, for the personal data you keep in Atitic. A data processing addendum under Art. 28 is part of the terms, and the data is hosted in the EU.

A summary for orientation, not legal advice. The official text is the reference.

Try it on your own data

Adopt GDPR in a free trial, link the evidence you already have and see what is still missing.

Start a free trial