Lawfulness, fairness, transparency
Notice obligations and a defensible legal basis for every purpose.
EU/EEA · Regulation 2016/679
GDPR with the accountability principle built in.
99 articles, 173 recitals, one platform. Notice, lawful basis, principal rights, transfers, and breach reporting — running from the same control library auditors and supervisory authorities trust.
Article 5 · Principles
Seven principles, six articles, one accountability obligation
The platform makes Article 5(2) demonstrable — every principle has a control, an owner, and live evidence.
Purpose limitation
Stated purpose at collection, no incompatible secondary use.
Data minimisation
Only what is necessary. Audited via field-level mapping.
Accuracy
Mechanisms to keep personal data current and correctable.
Storage limitation
Retention rules per category, automated tombstoning.
Integrity & confidentiality
Security measures appropriate to risk — Article 32.
Accountability
Documentation that proves you operate under (1) (a)–(f).
Chapter III · Rights of the data subject
Eight rights, eight workflows
Each right has an SLA (typically one calendar month, extensible to three) and a fulfilment trail.
Access
Rectification
Erasure
Restriction
Notification
Portability
Object
Auto-decision
Chapter V · International transfers
Pick the right mechanism. Document the assessment. Audit the change.
| Mechanism | Scope | Typical trigger |
|---|---|---|
| Adequacy decision | Approved third country list | Default — when listed by Commission |
| Standard Contractual Clauses | Module 1–4 per controller / processor relationship | Most common SaaS path |
| Binding Corporate Rules | Intra-group, requires DPA approval | Group multinationals |
| Derogations · Art 49 | Limited and exceptional | Last resort only |
Articles 33–34 · Breach notification
72-hour decision, documented end to end
Detection
Automatic incident from SIEM, IDS, or fiduciary triggers
Assessment
Severity, data classes, risk to data subjects
DPO review
Notifiability decision, drafting of communications
Notification
Supervisory authority — Article 33
Communication
Data subjects when high-risk — Article 34
Demonstrable accountability — not slide ware
Run RoPA, DSAR, transfers, and breach decisions on one operational graph supervisory authorities recognize.