What does GDPR compliant mean?
GDPR compliant means that a specific processing of personal data meets the requirements of the General Data Protection Regulation (Regulation (EU) 2016/679) and that the controller can prove it. What is compliant is processing at a particular company, not a product: software can enable lawful use, but responsibility for the processing stays with the controller.
Proof is part of the obligation. Under Article 5(2) GDPR, the controller must be able to demonstrate compliance with the principles ("accountability"). Article 24(1) requires technical and organizational measures that ensure compliance and make it demonstrable, reviewed and updated where necessary.
In Germany, the Federal Data Protection Act (BDSG) applies alongside. The duties in context are set out in the GDPR guide.
What does GDPR compliance include?
Alongside the principles of Article 5, such as storage limitation, compliance covers these ten areas of duty, each with its own legal source and its own evidence.
| Duty | Legal source | Evidence |
|---|---|---|
| Legal basis for each processing | Art. 6(1) | Entry in the record of processing activities, consent records |
| Record of processing activities | Art. 30 | Record; exemption under para. 5 only after checking the counter-exceptions |
| Information duties | Art. 13 and 14 | Privacy notices |
| Data subject rights | Art. 15 to 22, deadline under Art. 12(3) | Process with a response within one month, extendable by two months |
| Data protection by design and by default | Art. 25 | Requirements for procurement and development |
| Security of processing | Art. 32 | Documentation of technical and organizational measures, effectiveness testing |
| Processing by processors | Art. 28 | Data processing agreements |
| Data protection impact assessment | Art. 35 | DPIA where high risk is likely |
| Personal data breaches | Art. 33 and 34 | Notification process; notification within 72 hours of becoming aware, unless the breach is unlikely to result in a risk |
| Data protection officer | Art. 37, § 38 BDSG | Designation and communication to the supervisory authority |
For the record under Article 30 there is a records of processing activities template with the mandatory fields.
Is there a GDPR certificate?
There is no official certificate that declares a company GDPR compliant as a whole. Article 42 GDPR provides for voluntary certifications, data protection seals and marks for processing operations. They are issued for a maximum of three years (para. 7) and do not reduce the controller's responsibility (para. 4).
An ISO/IEC 27001 certificate attests an information security management system, not the lawfulness of processing. What the two share are the measures under Article 32 GDPR: pseudonymization and encryption, confidentiality, integrity, availability and resilience of systems, timely restoration and a process for regularly testing effectiveness.
These measures can be documented once for both the ISMS and data protection. Where the disciplines part ways is shown in the comparison data protection vs information security.
GDPR check: reviewing one processing activity
A GDPR check, also called a data protection audit, compares a processing activity as it actually runs with the principles and the ten areas of duty. Check in the system, not only in documents: a record can name a retention period that nobody enforces. Internally, monitoring compliance is one of the data protection officer's tasks under Article 39(1)(b) GDPR.
Fictional example: check of the processing "customer service via a ticketing system". The figures are invented for illustration.
| Duty | Check | Finding | Evidence |
|---|---|---|---|
| Legal basis (Art. 6(1)) | Read the entry in the record of processing activities | Point (b) (contract) documented | Record entry |
| Information (Art. 13) | Compare the privacy notice with purpose and recipients | Ticketing provider named as recipient | Notice with date |
| Processor (Art. 28) | Review the agreement with the software provider | Agreement signed, list of sub-processors available | Agreement with date |
| Storage limitation (Art. 5(1)(e)) | Search the system for tickets older than the set period of three years after closure | 1,240 tickets past the period | Query result |
| Access (Art. 15, Art. 12(3)) | Test request for a test account: export all tickets and attachments | Complete, two hours of effort | Log |
| Security (Art. 32) | Check administrator accounts for multi-factor authentication | 2 of 9 administrators without a second factor | Account settings export |
Result: legal basis, information, agreement and access are evidenced. Two findings become measures with an owner and a due date: automatic deletion after the period ends and a second factor for all administrators. Repeat the sample checks after implementation and file the results with the record entry.
Data protection concept: what goes in it
A data protection concept is the coherent documentation a company uses to describe and prove how it complies with the GDPR. The term does not appear in the regulation; the duty behind it follows from Article 5(2) and Article 24(1). The company decides what the document is called and how it is structured. This structure covers the evidence from the check:
- Scope and responsibilities
- Record of processing activities with purpose, legal basis and retention period
- Technical and organizational measures under Article 32, with references to existing ISMS evidence
- Deletion concept
- Processes for data subject rights, data breaches and the review of new service providers
- List of processors
- Results of the latest checks and the date of the next review
GDPR-compliant software: five questions
In everyday usage, software is called GDPR compliant if it enables lawful use. Ask before choosing:
- Does the provider offer a data processing agreement under Article 28 GDPR?
- Are its technical and organizational measures documented?
- Is data transferred to third countries, and on what basis?
- Can data be selectively deleted, exported and compiled for an access request?
- Do the default settings allow data-minimizing use within the meaning of Article 25(2)?
How these questions carry over to AI services is shown in ChatGPT and data protection.
What are the consequences of non-compliance?
Non-compliance can lead to fines, orders from the supervisory authority and claims for damages. Article 83(4) GDPR provides for up to EUR 10 million or 2% of worldwide annual turnover, among others for infringements of Articles 25 to 39. For infringements of the principles, the legal bases and data subject rights, paragraph 5 provides for up to EUR 20 million or 4%, in each case whichever is higher. Data subjects can claim compensation for material and non-material damage under Article 82.
GDPR in Rizzqo
In Rizzqo, you record each processing activity as a process, mark whether it involves personal data and assign a responsible person. The systems and provider services behind it then show that they hold personal data. This gives you one list of every place where personal data sits.