Compliance FrameworksEurope
GDPR
Privacy by design, integrity & confidentiality, data protection impact assessment.
Privacy by design, integrity & confidentiality, data protection impact assessment.
| Region | Europe |
| Country or scope | European Union |
| Sector | Privacy |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers GDPR
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for GDPR.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for GDPR and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
EU-GDPR-32 Security of Processing | Controllers and processors must implement technical measures ensuring ongoing integrity and resilience of processing systems, including the ability to verify that processing software is authentic and unmodified (GDPR Art. 32(1)(b)) | Scan |
EU-GDPR-30 Records of Processing Activities | Controllers must maintain records of processing activities including a general description of security measures, which presupposes an inventory of the software performing the processing (GDPR Art. 30) | Scan |
EU-GDPR-28 Processor Chain Control | Processing may only be entrusted to processors providing sufficient guarantees, and sub-processors require authorisation, so the suppliers behind processing components must be identified (GDPR Art. 28) | Scan |
EU-GDPR-25 Data Protection by Design | Data protection must be built in at the time of determining the means of processing, requiring documented, identifiable and dated records of the system's composition (GDPR Art. 25) | Scan |
EU-GDPR-33 Breach Notification Readiness | Personal data breaches must be notified to the supervisory authority within 72 hours where feasible, which requires the ability to determine quickly which software components and versions were affected (GDPR Art. 33) | Scan |
EU-GDPR-5-2 Accountability Evidence | Controllers must be able to demonstrate compliance with the processing principles, supported by composition evidence whose creator and provenance are recorded (GDPR Art. 5(2)) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
GDPR-ART5 | Ensure Lawfulness, Fairness, and Transparency of Processing |
GDPR-ART6 | Establish Lawful Basis for Processing |
GDPR-ART7 | Manage Consent Effectively |
GDPR-ART13-14 | Provide Data Subject Information at Collection |
GDPR-ART15-22 | Implement Data Subject Rights Fulfilment Process |
GDPR-ART25 | Implement Privacy by Design and by Default |
GDPR-ART30 | Maintain Records of Processing Activities |
GDPR-ART32 | Implement Appropriate Technical and Organisational Security Measures |
GDPR-ART33 | Report Personal Data Breaches to Supervisory Authority Within 72 Hours |
GDPR-ART34 | Notify Data Subjects of High-Risk Breaches |
GDPR-ART35 | Conduct Data Protection Impact Assessments |
GDPR-ART28 | Execute Data Processing Agreements with Processors |
Policy templates
Written for GDPR:
- GDPR Data Protection Policy
- GDPR Personal Data Breach Response Policy
- GDPR Processor Management Policy
And 22 from the standard set, adapted to GDPR.