Catalog
concept#Governance#Security#Data

General Data Protection Regulation (GDPR)

The GDPR is an EU regulation that governs protection of personal data, the rights of data subjects, and obligations for controllers and processors.

The General Data Protection Regulation (GDPR) is an EU regulation that governs the protection of personal data and the rights of data subjects.
Established
High

Classification

  • High
  • Organizational
  • Organizational
  • Intermediate

Technical context

Identity and access management systemsLogging and monitoring platformsContract management and vendor risk tools

Principles & goals

Data minimization: process only necessary data.Purpose limitation: use data only for clearly defined purposes.Accountability: demonstrate compliance via documentation and processes.
Discovery
Enterprise, Domain

Use cases & scenarios

Compromises

  • Insufficient technical measures can lead to data loss or misuse.
  • Unclear responsibilities enable compliance gaps.
  • Poor documentation increases fines and liability risks.
  • Embed privacy by design and by default in development processes.
  • Regularly review and update records of processing activities.
  • Establish standardized processes for data subject rights and security incidents.

I/O & resources

  • Records of processing activities and data flow diagrams
  • Contractual agreements with third-party processors
  • Technical security requirements and architecture overviews
  • GDPR-compliant policies and procedures
  • Documented DPIA reports and risk assessments
  • Contractually secured data processing relationships

Description

The General Data Protection Regulation (GDPR) is an EU regulation that governs the protection of personal data and the rights of data subjects. It defines obligations for controllers and processors, establishes legal bases for processing, and requires technical and organizational measures to ensure data protection and accountability.

✔

  • Improved protection of personal data and increased customer trust.
  • Clear responsibilities and obligations within the organization.
  • Reduced risk of fines and legal sanctions.

✖

  • Regulatory requirements can slow down innovation.
  • Extensive documentation obligations create administrative overhead.
  • Not all legal questions are interpreted uniformly across the EU (ambiguities).

  • Number of processed data subject requests

    Measures efficiency and compliance with deadlines for access and deletion requests.

  • Number of data breaches

    Counts security incidents involving personal data and their severity.

  • Completion rate of DPIA actions

    Share of DPIA-identified measures that were successfully implemented.

Company-wide GDPR compliance program

A mid-sized company implemented processing records, role models and trainings to meet regulatory requirements.

DPIA for health data processing

For a health data analytics project a DPIA was conducted and additional encryption and anonymization measures were implemented.

Process for handling access requests

An online shop established a standardized process covering identity verification, deadline management and logging.

1

Carry out an inventory of processing activities and create a records of processing.

2

Formally assign roles and responsibilities, including a data protection officer.

3

Conduct DPIAs for high-risk processing activities.

4

Define and implement technical and organizational measures.

5

Introduce training and awareness measures for staff.

⚠️ Technical debt & bottlenecks

  • Legacy systems lacking logging and deletion mechanisms remain in place.
  • Insufficient encryption of sensitive data in databases.
  • Missing automation for cleanup and anonymization processes.
Insufficient documentationOrganizational responsibilitiesTechnical integration points
  • Insufficient deletion processes lead to unnecessary retention of personal data.
  • Transferring data to third parties without appropriate contracts.
  • Automated decisions without assessing discrimination risks.
  • Overreliance on technical measures without organizational changes.
  • Underestimating cross-border legal requirements.
  • Lack of demonstrability for processes and decisions.
Knowledge of data protection lawIT security and system knowledgeProcess and risk management skills
Legal certainty and demonstrabilityAvailability and integrity of personal dataMinimization of data exposure and access
  • • Legal deadlines for notifications and access responses
  • • Regional legal differences inside and outside the EU
  • • Limited resources for audits and controls