Personal data protection

GDPR: accountability (Art. 5), records of processing, security, personal data breaches and DPIAs

Records of processing (Art. 30), Article 32 measures, breaches (Arts. 33-34) and data subject requests, with the evidence for the supervisory authority.

Let's talkStarting assessment

The General Data Protection Regulation requires controllers and processors not only to comply with the rules but to be able to demonstrate it: the accountability principle. National laws complement it in each Member State, and each country has a supervisory authority; in Italy, the Privacy Code as amended by Legislative Decree 101/2018 and the Garante per la protezione dei dati personali.

Who it applies to

  • Controllers and processors handling personal data in the context of an establishment in the Union, of any size and sector.
  • Organisations outside the Union that offer goods or services to people in the Union or monitor their behaviour.
  • Service providers processing data on behalf of customers, as processors.

What it requires

  1. 01

    Principles and accountability

    Lawfulness, data minimisation, storage limitation and the ability to demonstrate compliance with the principles (Art. 5).

  2. 02

    Records of processing

    Purposes, categories of data and data subjects, recipients, transfers, retention periods and security measures (Art. 30).

  3. 03

    Security of processing

    Technical and organisational measures appropriate to the risk, regularly tested (Art. 32).

  4. 04

    Personal data breaches

    Notification to the authority within 72 hours where there is a risk, communication to data subjects where the risk is high, documentation of every breach (Arts. 33 and 34).

  5. 05

    Impact assessment

    DPIA for processing likely to result in a high risk to the rights and freedoms of individuals (Art. 35).

  6. 06

    Rights and processors

    Replies to data subject requests within one month, contracts with processors (Art. 28) and safeguards for transfers outside the EU.

Timeline

  1. 24 May 2016Regulation enters into force.
  2. 25 May 2018Application across the Union.

EVIDEVO

How EVIDEVO manages controls and evidence for GDPR

Linked records of processing

Every processing activity is linked to systems, vendors, security measures and an owner, with the date of the last review.

Shared Article 32 measures

Security measures are the same controls used for ISO/IEC 27001 and NIS2, with the same evidence.

Breaches and the 72-hour deadline

In Incidents and notifications, every breach records its 72-hour clock, the decisions taken and the documentation required by Article 33, even when it is not notified.

DPIAs and data subject requests

Impact assessments and data subject requests with due date, owner and history of replies.

Data for illustrative purposes only, not real

What can be exported

  • Records of processing activities
  • Personal data breach register
  • Evidence of security measures and DPIAs by processing activity

Capabilities for GDPR

How to determine whether GDPR applies

Sector, size and services define the scope. The starting assessment identifies it and sets the priorities.

Starting assessment

Guides on GDPR

Frameworks that share evidence

Informational summary, updated October 2026. Not legal advice: applicability and obligations should be checked against the official text and the specific case.

A thirty-minute presentation based on the organisation's scope.

It starts from the frameworks in scope and how the work is organised today. In thirty minutes, EVIDEVO is shown working in that context.

Let's talk