GDPR

Requirements and controls

• Chapter 1 General Provisions of GDPR

  • Article 1 Subject-matter and objectives

    Establishes that the Regulation protects people's fundamental rights over the processing of their personal data while allowing that data to move freely within the EU.

    • Cross-Border Data Transfers
    • Data Protection Policy & Procedure
    • Published Privacy Policy

  • Article 2 Material scope

    Applies the Regulation to personal data processed wholly or partly by automated means or held in a filing system, with exclusions such as purely personal or household activities.

    • Data Protection Policy & Procedure
    • Cross-Border Data Transfers
    • Published Privacy Policy

  • Article 3 Territorial scope

    Covers organizations established in the EU and those outside it that offer goods or services to, or monitor the behavior of, people in the EU.

    • Data Protection Policy & Procedure
    • Cross-Border Data Transfers
    • Published Privacy Policy

  • Article 4 Definitions of terms under GDPR

    Defines the key terms used throughout the Regulation, such as personal data, processing, controller, processor, consent and personal data breach.

    • Third-Party Criticality Assessments
    • Management Review of Third-Party Risks
    • Vendor Management Policy & Procedure
    • Processor Data Protection Agreements
    • Cross-Border Data Transfers

• Chapter 2 Principles related to processing of personal data

  • Article 5 Principles relating to processing of personal data

    Personal data must be processed lawfully, fairly and transparently, for specified purposes, limited to what is necessary, kept accurate, retained no longer than needed and kept secure, and the controller must be able to show compliance.

    • Data Protection Policy & Procedure
    • Cross-Border Data Transfers
    • Consent Management
    • Personal Data Inventory
    • Data Subject Requests

  • Article 6 Lawfulness of processing

    Processing is lawful only when it rests on at least one legal basis, such as consent, a contract, a legal obligation, vital interests, a public task or legitimate interests.

    • Data Protection Policy & Procedure
    • Cross-Border Data Transfers
    • Personal Data Inventory
    • Consent Management
    • Processor Data Protection Agreements
    • Data Protection Impact Assessments

  • Article 7 Conditions for consent

    When relying on consent, the controller must be able to prove it was freely given, specific, informed and unambiguous, and must let people withdraw it as easily as they gave it.

    • Personal Data Inventory
    • Consent Management
    • Data Protection Impact Assessments
    • Vendor Management Policy & Procedure
    • Processor Data Protection Agreements

  • Article 8 Conditions applicable to child's consent in relation to information society services

    When online services are offered directly to a child below the age of digital consent (16 by default, which Member States may lower to no less than 13), consent must be given or authorized by a parent or guardian.

    • Disaster Recovery Testing
    • Vendor Management Policy & Procedure
    • Personal Data Inventory
    • Consent Management
    • Processor Data Protection Agreements
    • Data Protection Impact Assessments

  • Article 9 Processing of special categories of personal data

    Processing special categories of data, such as health, genetic, biometric, racial or ethnic origin, religious beliefs or sexual orientation, is prohibited unless a specific exception such as explicit consent applies.

    • Information Security & Privacy Policies
    • Personal Data Inventory
    • Processor Data Protection Agreements
    • Data Protection Impact Assessments

  • Article 10 Processing of personal data relating to criminal convictions and offences

    Personal data about criminal convictions and offences may only be processed under official authority or where EU or Member State law allows it with appropriate safeguards.

    • Information Security & Privacy Policies
    • Personal Data Inventory
    • Processor Data Protection Agreements
    • Data Protection Impact Assessments
    • Published Privacy Policy
    • Privacy Notices on Data Collection Forms

  • Article 11 Processing which does not require identification

    A controller does not have to obtain extra information just to identify people for GDPR purposes when its processing does not otherwise require identifying them.

    • Access Control Policy & Procedure
    • Identity Validation
    • Termination of Employment
    • Production Database Access Restriction
    • Limit Network Connections
    • Multi-Factor Authentication
    • User Privilege Reviews
    • User Access Reviews
    • Malware Protection
    • External System Connections

• Chapter 3 Rights of the Data Subject

  • Article 12 Transparent information, communication and modalities for the exercise of the rights of the data subject

    Controllers must provide information and respond to rights requests in a concise, transparent and easily accessible way, normally free of charge and within one month.

    • Encryption of Data at Rest
    • Transmission Confidentiality
    • Capacity & Performance Management
    • Vendor Management Policy & Procedure
    • Processor Data Protection Agreements
    • Data Subject Requests
    • EU Representative
    • Published Privacy Policy
    • Privacy Notices on Data Collection Forms
    • Privacy by Design Policy

  • Article 13 Information to be provided where personal data are collected from the data subject

    When collecting data directly from people, controllers must tell them who is processing it, for what purposes and on what legal basis, who receives it, how long it is kept and what rights they have.

    • Personal Data Inventory
    • Data Subject Requests
    • Published Privacy Policy
    • Privacy Notices on Data Collection Forms

  • Article 14 Information to be provided where personal data have not been obtained from the data subject

    When personal data comes from another source, controllers must give people the same transparency information plus the categories and source of the data within a reasonable time.

    • Personal Data Inventory
    • Consent Management
    • Data Subject Requests
    • Privacy Officer
    • Published Privacy Policy
    • Privacy Notices on Data Collection Forms

  • Article 15 Right of access by the data subject

    People can find out whether their personal data is being processed and get a copy of it, along with details of the purposes, recipients, retention period and their rights.

    • Data Subject Requests
    • Personal Data Inventory
    • Privacy Officer
    • Processor Data Protection Agreements
    • Vendor Management Policy & Procedure
    • Third-Party Criticality Assessments

  • Article 16 Right to rectification

    People can have inaccurate personal data about them corrected, and incomplete data completed, without undue delay.

    • Data Subject Requests
    • Published Privacy Policy
    • Privacy Notices on Data Collection Forms

  • Article 17 Right to erasure (‘right to be forgotten’)

    People can have their personal data erased without undue delay in cases such as when it is no longer needed, consent is withdrawn or it was processed unlawfully.

    • Data Subject Requests
    • Privacy Officer
    • Published Privacy Policy
    • Privacy Notices on Data Collection Forms

  • Article 18 Right to restriction of processing

    People can require the controller to limit processing of their data in certain situations, such as while its accuracy is disputed or an objection is being assessed.

    • Access Control Policy & Procedure
    • Personal Data Inventory
    • Data Subject Requests
    • Privacy Officer
    • Published Privacy Policy

  • Article 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing

    Controllers must tell each recipient of the data about any correction, erasure or restriction carried out, unless that proves impossible or takes disproportionate effort.

    • Data Subject Requests
    • Privacy Officer
    • Published Privacy Policy

  • Article 20 Right to data portability

    People can receive the personal data they provided in a structured, commonly used, machine-readable format and have it sent to another controller when processing is automated and based on consent or a contract.

    • Privacy Officer
    • Published Privacy Policy
    • Data Subject Requests
    • Processor Data Protection Agreements
    • Personal Data Inventory

  • Article 21 Right to object

    People can object to processing based on public interest or legitimate interests, and to direct marketing at any time, after which the controller must stop unless it has compelling legitimate grounds.

    • Personal Data Inventory
    • Consent Management
    • Data Subject Requests
    • Published Privacy Policy

  • Article 22 Automated individual decision-making, including profiling

    People have the right not to be subject to decisions based solely on automated processing, including profiling, that have legal or similarly significant effects, except in limited cases with safeguards.

    • Personal Data Inventory
    • Consent Management
    • Data Subject Requests
    • Published Privacy Policy

  • Article 23 Restrictions

    EU or Member State law may restrict certain rights and obligations where necessary and proportionate to protect interests such as national security, crime prevention or important public interests.

    • Data Protection Policy & Procedure
    • Cross-Border Data Transfers
    • Privacy Officer
    • Published Privacy Policy

• Chapter 4 Controller and Processor

  • Article 24 Responsibility of the controller

    Controllers must put appropriate technical and organizational measures, including data protection policies, in place to make sure, and be able to show, that processing complies with the Regulation.

    • Test Data Protection
    • Endpoint Security Policy
    • Unauthorized Activity Monitoring
    • Cross-Border Data Transfers
    • Breach Risk Assessment & Notification
    • Business Continuity Policy & Procedure
    • Disaster Recovery Policy
    • Anomalous Behavior Detection
    • Capacity & Performance Management
    • Change Management Policy & Procedure
    • Secure System Modification
    • Data Classification Labels
    • Privacy Officer
    • Published Privacy Policy

  • Article 25 Data protection by design and by default

    Data protection must be built into systems and processes from the design stage, and by default only the personal data needed for each purpose should be processed.

    • Test Data Protection
    • Endpoint Security Policy
    • Unauthorized Activity Monitoring
    • Breach Risk Assessment & Notification
    • Anomalous Behavior Detection
    • Business Continuity Policy & Procedure
    • Disaster Recovery Policy
    • Risk Framing
    • Risk Assessment
    • Third-Party Criticality Assessments
    • Limit Network Connections
    • Malware Protection
    • Encryption of Data at Rest
    • Management Review of Third-Party Risks
    • Risk Assessment Policy & Procedure
    • Data Protection Impact Assessments
    • Endpoint Security Validation
    • Session Lock
    • Media Disposal Policy
    • External System Connections
    • Vulnerability Remediation Process
    • Centralized Flaw Remediation
    • Data Backup Policy
    • Change Management Policy & Procedure
    • Secure System Modification
    • Approval of Changes
    • Password Management Guidelines
    • Published Privacy Policy
    • Management Review of Policies
    • Data Breach Notification Policy
    • Privacy by Design Policy
    • PII Breach Notification Guidelines

  • Article 26 Joint controllers

    When two or more controllers jointly decide why and how data is processed, they must agree and make transparent how they share their responsibilities.

    • Third-Party Criticality Assessments
    • Risk Assessment Policy & Procedure
    • Published Privacy Policy
    • Data Subject Requests
    • Processor Data Protection Agreements
    • Vendor Management Policy & Procedure
    • Management Review of Policies
    • Cross-Border Data Transfers
    • Data Retention Policy

  • Article 27 Representatives of controllers or processors not established in the Union

    Controllers and processors outside the EU that are subject to the Regulation must appoint a representative in the EU in writing, with limited exceptions.

    • Cross-Border Data Transfers
    • Processor Data Protection Agreements
    • EU Representative
    • Privacy Officer

  • Article 28 Processor

    Controllers may only use processors that give sufficient guarantees, under a binding contract that sets out the processor's obligations, including rules on sub-processors.

    • Processor Data Protection Agreements
    • Risk Assessment Policy & Procedure
    • Vendor Management Policy & Procedure
    • Third-Party Criticality Assessments
    • Contractual Obligations Register
    • Cross-Border Data Transfers

  • Article 29 Processing under the authority of the controller or processor

    Processors and anyone acting under a controller's or processor's authority may process personal data only on the controller's instructions unless the law requires otherwise.

    • Risk Assessment Policy & Procedure
    • Vendor Management Policy & Procedure
    • Cross-Border Data Transfers
    • Processor Data Protection Agreements

  • Article 30 Records of processing activities

    Controllers and processors must keep written records of their processing activities, including purposes, data categories, recipients, international transfers, retention periods and security measures.

    • Personal Data Inventory
    • Malware Protection
    • Limit Network Connections
    • Encryption of Data at Rest
    • Inventory of Infrastructure Assets
    • Data Subject Requests
    • Privacy Officer
    • Published Privacy Policy
    • Privacy Notices on Data Collection Forms
    • External System Connections

  • Article 31 Cooperation with the supervisory authority

    Controllers, processors and their representatives must cooperate with the supervisory authority when it asks.

    • Publishing Security & Privacy Documentation
    • Management Review of Policies
    • EU Representative
    • Breach Risk Assessment & Notification
    • Privacy Officer

  • Article 32 Security of processing

    Controllers and processors must apply security measures suited to the risk, such as encryption, pseudonymization, resilience, the ability to restore data and regular testing of those measures.

    • Test Data Protection
    • Endpoint Security Policy
    • Unauthorized Activity Monitoring
    • Breach Risk Assessment & Notification
    • Business Continuity Policy & Procedure
    • Disaster Recovery Policy
    • Anomalous Behavior Detection
    • Risk Framing
    • Risk Assessment
    • Fraud Risk Assessment
    • Limit Network Connections
    • Malware Protection
    • Encryption of Data at Rest
    • Management Review of Third-Party Risks
    • Risk Assessment Policy & Procedure
    • Password Management Guidelines
    • Endpoint Encryption
    • Impact Analysis
    • Publishing Security & Privacy Documentation
    • Endpoint Security Validation
    • Session Lock
    • Media Disposal Policy
    • External System Connections
    • Vulnerability Remediation Process
    • Centralized Flaw Remediation
    • Data Backup Policy
    • Data Backups
    • Backup Restoration Testing
    • Change Management Policy & Procedure
    • Secure System Modification
    • Approval of Changes
    • Internal Audit
    • Management Review of Policies
    • Assigned Security & Privacy Responsibilities
    • Security & Privacy Program Review
    • Management Review of Org Chart
    • Management Review of Risks
    • Production System Access Review
    • Subservice Organization Evaluation
    • Information Security & Privacy Policies
    • Segregation of Duties
    • Asset Ownership Assignment
    • People Operations Owner
    • Compliance Program Manager
    • Human Resources Policy & Procedure
    • Network Security Policy & Procedure
    • Cybersecurity Responsibilities

  • Article 33 Notification of a personal data breach to the supervisory authority

    Controllers must report a personal data breach to the supervisory authority without undue delay and, where feasible, within 72 hours, unless it is unlikely to put people at risk.

    • Automated Incident Reporting
    • Incident Reporting Assistance
    • Incident Management Policy & Procedure
    • Incident Tracking
    • Breach Risk Assessment & Notification
    • Disaster Recovery Policy
    • Business Continuity Policy & Procedure

  • Article 34 Communication of a personal data breach to the data subject

    When a breach is likely to put people at high risk, the controller must tell the affected individuals without undue delay in clear and plain language.

    • Inventory of Infrastructure Assets
    • Incident Management Policy & Procedure
    • Data Protection Policy & Procedure
    • Data Subject Requests
    • Breach Risk Assessment & Notification

  • Article 35 Data protection impact assessment

    Before starting processing that is likely to pose a high risk to people, controllers must carry out a data protection impact assessment.

    • Data Protection Policy & Procedure
    • Data Protection Impact Assessments
    • Risk Assessment
    • Risk Framing
    • Third-Party Criticality Assessments

  • Article 36 Prior consultation

    Controllers must consult the supervisory authority before processing when an impact assessment shows a high risk they cannot sufficiently reduce.

    • Risk Framing
    • Risk Assessment
    • Risk Assessment Policy & Procedure
    • Vendor Management Policy & Procedure

  • Article 37 Designation of the data protection officer

    A data protection officer must be appointed by public authorities and by organizations whose core activities involve large-scale monitoring of people or large-scale processing of sensitive data.

    • Assigned Security & Privacy Responsibilities
    • Internal Audit
    • Privacy Officer

  • Article 38 Position of the data protection officer

    The data protection officer must be involved in all data protection matters, given the resources needed, report to top management and not be instructed or penalized for doing the job.

    • Code of Business Conduct
    • New Hire Policy Acknowledgement
    • Assigned Security & Privacy Responsibilities
    • Privacy Officer

  • Article 39 Tasks of the data protection officer

    The data protection officer advises the organization and its staff, monitors compliance, advises on impact assessments and acts as the contact point for the supervisory authority.

    • Code of Business Conduct
    • New Hire Policy Acknowledgement
    • Assigned Security & Privacy Responsibilities
    • Information Security & Privacy Policies
    • Privacy Officer

  • Article 40 Codes of conduct

    Industry associations and similar bodies can draw up codes of conduct, approved by supervisory authorities, that explain how the Regulation applies in their sector.

    • Code of Business Conduct
    • New Hire Policy Acknowledgement
    • Information Security & Privacy Policies
    • Security & Privacy Awareness
    • Periodic Policy Acknowledgement
    • Automated Incident Reporting
    • New Hire Security & Privacy Training
    • Periodic Security & Privacy Training

  • Article 42 Certification

    Certification schemes, seals and marks can be used to demonstrate that a controller's or processor's processing complies with the Regulation.

    • Privacy Officer
    • Cross-Border Data Transfers

  • Article 43 Certification bodies

    Certification bodies must be accredited and meet independence and expertise requirements before they issue or renew GDPR certifications.

    • Cross-Border Data Transfers
    • Privacy Officer

• Chapter 5 Transfers of personal data to third countries or international organisations

  • Article 44 General principle for transfers

    Personal data may only be transferred outside the EU if the conditions of the transfer chapter are met, so the level of protection people have is not undermined.

    • Cross-Border Data Transfers
    • Processor Data Protection Agreements
    • Vendor Management Policy & Procedure
    • Subservice Organization Evaluation
    • Third-Party Criticality Assessments

  • Article 45 Transfers on the basis of an adequacy decision

    Transfers may take place without further authorization to countries or organizations that the European Commission has found to provide an adequate level of protection.

    • Third-Party Criticality Assessments
    • Management Review of Third-Party Risks
    • Subservice Organization Evaluation
    • Vendor Management Policy & Procedure
    • Cross-Border Data Transfers
    • Processor Data Protection Agreements

  • Article 46 Transfers subject to appropriate safeguards

    Without an adequacy decision, transfers need appropriate safeguards, such as standard contractual clauses or binding corporate rules, along with enforceable rights and effective remedies for people.

    • Periodic Security & Privacy Training
    • Third-Party Criticality Assessments
    • Management Review of Third-Party Risks
    • Subservice Organization Evaluation
    • Vendor Management Policy & Procedure
    • Cross-Border Data Transfers
    • Processor Data Protection Agreements
    • Data Retention Policy
    • Privacy Notices on Data Collection Forms
    • Asset Inventory Updates
    • Inventory of Endpoint Assets
    • Vulnerability Management Policy & Procedure
    • Disaster Recovery Policy
    • Centralized Security Logging
    • New Hire Security & Privacy Training
    • Physical Protection Policy & Procedure

  • Article 47 Binding corporate rules

    Supervisory authorities approve binding corporate rules that let a corporate group transfer personal data across borders within the group.

    • Third-Party Criticality Assessments
    • Management Review of Third-Party Risks
    • Vendor Management Policy & Procedure
    • Cross-Border Data Transfers
    • Processor Data Protection Agreements

  • Article 48 Transfers or disclosures not authorised by Union law

    A court ruling or decision from a non-EU authority demanding the transfer or disclosure of personal data is only enforceable if it is based on an international agreement such as a mutual legal assistance treaty.

    • Third-Party Criticality Assessments
    • Management Review of Third-Party Risks
    • Vendor Management Policy & Procedure
    • Cross-Border Data Transfers
    • Processor Data Protection Agreements

  • Article 49 Derogations for specific situations

    Without adequacy or appropriate safeguards, transfers are allowed only in specific situations, such as explicit consent, performance of a contract or important reasons of public interest.

    • Third-Party Criticality Assessments
    • Management Review of Third-Party Risks
    • Vendor Management Policy & Procedure
    • Cross-Border Data Transfers
    • Processor Data Protection Agreements

  • Article 50 International cooperation for the protection of personal data

    The Commission and supervisory authorities work with non-EU countries and international organizations to build cooperation for enforcing personal data protection.

    • Third-Party Criticality Assessments
    • Management Review of Third-Party Risks
    • Vendor Management Policy & Procedure
    • Cross-Border Data Transfers
    • Processor Data Protection Agreements