GDPR compliant: what your company has to be able to demonstrate

What does GDPR compliant mean?

The word does not appear in the GDPR. What it means is what Art. 5 requires: personal data is processed according to six principles, and the controller is responsible for complying with them and must be able to demonstrate it.

The principles in Art. 5(1) are lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality.

Paragraph 2 calls the duty to demonstrate accountability. Complying and proving it therefore go together: when your company is asked, it shows how it puts the principles into practice.

Art. 5(1) and (2) GDPR

What Art. 24 asks of your company

Art. 24(1) turns this into a duty to act. The controller implements appropriate technical and organisational measures to ensure that processing complies with the GDPR and to be able to demonstrate it. What is appropriate depends on the nature, scope, context and purposes of the processing and on the risks to people's rights and freedoms.

The measures are reviewed and updated where necessary. Where proportionate to the processing, they include appropriate data protection policies (paragraph 2); the German text says “Datenschutzvorkehrungen”, in our reading written rules either way.

For a company with 50 to 250 staff this means, in our reading: records for what you actually process, as detailed as the risk requires. Payroll needs different safeguards from tracking employees' locations.

Art. 24(1) and (2) GDPR

Which records carry the proof

The record of processing activities shows what you process and why, and you make it available to the supervisory authority on request (Art. 30(1) and (4)). The TOMs describe how you protect the data (Art. 32). Data processing agreements show that your service providers are bound (Art. 28).

Where a data protection impact assessment is required, it belongs here too (Art. 35). You document personal data breaches with the facts, effects and remedial action, by the wording including those you do not have to notify (Art. 33(5)). Where processing is based on consent, you must be able to demonstrate the consent (Art. 7(1)).

We cover the record of processing, TOMs, DPAs, the DPIA and data breaches in an article each.

Art. 7(1) · Art. 28 · Art. 30 · Art. 32 · Art. 33(5) · Art. 35 GDPR

An example: the authority asks

Lenz Kunststofftechnik GmbH (made up, 160 staff) gets a letter from the data protection authority of its federal state. A former applicant has complained that his documents are still stored. The authority wants to know how Lenz handles applicant data.

Lenz produces the entry “Applications” from its record of processing with purpose and erasure period, the DPA with the vendor of its applicant portal, and the TOMs for the portal. The company adds the log of the last deletion run.

Had the erasure period only been in its privacy notice, Lenz could have named it but not proven that it is kept. That is exactly the difference Art. 5(2) makes, here for the principle of storage limitation (paragraph 1(e)).

Common mistakes

Relying on a seal or on a vendor's claim. A certification under Art. 42 relates to processing operations and does not reduce your responsibility (paragraphs 1 and 4). The GDPR's obligations fall on controllers and processors. Whether a piece of software fits depends on how you use it.

Writing the records once and leaving them. Art. 24(1) requires the measures to be reviewed and updated where necessary; an old record proves an old state.

Taking the exemption for organisations with fewer than 250 employees as a general one. It concerns the record of processing and falls away once a processing is not occasional, such as the monthly payroll (Art. 30(5)).

Art. 24(1) · Art. 30(5) · Art. 42(1) and (4) GDPR

With an AI assistant

An AI assistant such as Claude, ChatGPT or Copilot can build an overview from the records you already have: which proof exists, which is missing and which is out of date, sorted by the principles in Art. 5(1). It can draft missing entries and prepare a reply to the authority.

Whether a measure is appropriate and what you send the authority is your company's decision. In our reading, a draft becomes proof only once you have checked it and adopted it. Whatever you show the assistant, its vendor processes too; settle first under which agreement that happens.

The NIS 2 walkthrough on nisd2.eu does not cover the GDPR. A GDPR walkthrough on nisd2.eu is in the works, with the same MCP server as the NIS 2 walkthrough.