Data Privacy Management for teams that already know how hard this is.

Enterprise Risk

DPIA risks roll up to the enterprise risk register

TPRM

Privacy third parties share the same vendor record as TPRM assessments

ISMS / ISO 27001

Security measures on processing activities map to controls in the ISMS

Incident Management

Personal data breaches flow through the same incident model used elsewhere in governance

Your ROPA lives in a tool that doesn't export relationship columns, so the data flows live in your head.

You run GDPR and Swiss FADP (or UK GDPR) and you've accepted duplicate records as the cost of multi-framework.

DSARs arrive by email and live in a shared inbox or a standalone tool with no link to your processing activities.

DPIAs, DPAs, and TIAs share no context and are filled in separately each time a new processing activity is added.

When your board or auditor asks what would be exposed if a particular vendor had an incident, the answer takes days.

A Record of Processing Activities is the inventory of processing operations that GDPR Article 30 requires controllers and processors to maintain. It documents each processing activity's purpose, categories of data subjects, categories of personal data, recipients, cross-border transfers, retention periods, and the technical and organisational measures in place. The record must be in writing, kept current, and made available to the supervisory authority on request. In practice, the relationship columns (who you collect from, where you store, who you send to) are the part most exports miss and most authorities ask for first.

↑ each answer is the atomic version; links to canonical articles coming

A DPIA is mandatory under GDPR Article 35 when processing is likely to result in high risk to the rights and freedoms of natural persons. The EDPB WP248 guidance lists nine criteria: large-scale evaluation or scoring, automated decision-making with legal effect, systematic monitoring, special-category data, vulnerable data subjects, novel technologies, data matching across controllers, processing requiring explicit consent as a condition, and processing that prevents the exercise of rights. Meeting two or more of the nine criteria typically triggers the requirement. Single-criterion processing may still warrant a DPIA where context indicates elevated risk.

↑ each answer is the atomic version; links to canonical articles coming

A Transfer Impact Assessment evaluates whether a cross-border transfer of personal data to a country without an EU adequacy decision has effective safeguards against government access and surveillance. The requirement was crystallised by the Schrems II judgment, which struck down the EU-US Privacy Shield and required transferring parties to assess, on a case-by-case basis, whether their chosen mechanism (typically Standard Contractual Clauses) provides equivalent protection in the destination country's legal environment. A TIA documents the destination, the mechanism, the surveillance exposure analysis, and any supplementary measures applied.

↑ each answer is the atomic version; links to canonical articles coming

Under GDPR Article 33, controllers must notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware, where the breach is likely to result in a risk to the rights and freedoms of natural persons. Where notification is made after 72 hours, reasons for the delay must be included. If the breach is also likely to result in a high risk to individuals, the controller must notify affected data subjects directly under Article 34. Processors must notify the controller without undue delay after becoming aware.

↑ each answer is the atomic version; links to canonical articles coming

Under GDPR Article 12, a controller must respond to a data subject access request without undue delay and within one calendar month of receipt. Where the request is complex or numerous, the period may be extended by a further two months, provided the data subject is informed of the extension and the reasons within the first month. The 30-day clock begins on receipt of the request, not on verification of the requester's identity, though identity verification is permitted before fulfilling the request itself.

↑ each answer is the atomic version; links to canonical articles coming

A Data Processing Agreement under GDPR Article 28 must define the subject matter, duration, nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller. It must require the processor to: process only on documented instructions; ensure confidentiality commitments for authorised personnel; implement appropriate technical and organisational security measures; engage sub-processors only with the controller's prior written consent; assist the controller with data subject rights, security, breach notification, DPIAs, and prior consultation obligations; delete or return all personal data on termination; and make available all information necessary to demonstrate compliance.

↑ each answer is the atomic version; links to canonical articles coming

When a processing activity is governed by both GDPR and Swiss FADP, the requirements differ: GDPR requires a lawful basis under Article 6 (and Article 9 for special categories), while Swiss FADP requires a justification under its own provisions and has different documentation timelines. Running two separate registers creates two copies of the same operational fact that drift apart. The operationally durable approach is to maintain one processing activity record and attach framework-specific attributes (legal basis, review cycle, export trail) independently. One record, two governance lanes, audit evidence kept separate by framework.

↑ each answer is the atomic version; links to canonical articles coming

The most effective mechanism is one-time, cryptographically scoped questionnaires sent to business owners with a link that expires on submission. The token scopes the editor to exactly the PA the owner is responsible for, nothing more. On submission, the token invalidates, the PA moves to a Questionnaire Received state, and the privacy team reviews and applies the answers. The state machine makes the approval step explicit: the privacy team is not chasing; they are approving. Drift is managed through object-level indicators on data element classifications and third-party changes, not through scheduled manual reviews.

↑ each answer is the atomic version; links to canonical articles coming

<strong>A data flow diagram in privacy compliance</strong> visualises how personal data moves through one processing activity: from the data subjects it originates with, through the data assets and systems that store and process it, to the third parties that receive it. A well-built diagram surfaces four things at once: the categories of data subjects affected; the specific data elements involved, with <strong>special-category data (GDPR Article 9)</strong> flagged separately; the residency or jurisdiction of every node where the data lives or is processed; and the role of every external party (controller, processor, sub-processor). Under <strong>GDPR Article 30</strong>, the data flow is implicit in the Record of Processing Activities; the diagram makes it visible. A diagram that omits country residencies, role distinctions, or special-category flags is not a data flow diagram. It is a system map. The structural difference matters because regulators and auditors ask about transfers, roles, and Article 9 exposure as their opening questions. A properly built flow answers all four before they are asked.

↑ each answer is the atomic version; links to canonical articles coming