GDPR.

The General Data Protection Regulation is directly applicable EU law protecting natural persons when their personal data is processed. Regulation (EU) 2016/679 has applied since 25 May 2018; GDPR is its English abbreviation. In Germany, the Federal Data Protection Act and sector-specific provisions in particular supplement the European framework.

The GDPR first asks whether processing is permitted and for what purpose. A secure database does not establish whether the information collected is necessary or how long it may be retained. Articles 5 and 6 GDPR connect principles and legal bases; Article 32 addresses processing security within that framework.

Data protection remains an ongoing task because purposes, data flows and services used change. Under Article 24 GDPR, the controller must implement appropriate measures, review their suitability and update them where necessary. A document completed once does not replace this continuing assessment.

Under Article 2, the GDPR applies to personal data processing covered there, regardless of company size. Examples include customer data, job applications and personal information in support content. Pseudonymised data also remains personal data where a person can be identified using additional information; genuinely anonymous information is classified differently.

Territorial scope follows from Article 3 GDPR. Besides processing in the context of an EU establishment, certain offers to people in the EU or monitoring of their behaviour by companies outside the EU may be covered. Server location or website accessibility alone does not decide the matter.

The role is determined for the specific activity: controllers decide purposes and means; processors process data on behalf of a controller. An organisation may have different roles for different activities. Articles 26 and 28 GDPR require appropriate arrangements for joint controllership and processing respectively; a contract heading alone does not clarify the actual role.

Accountability under Article 5(2) GDPR means being able to explain and demonstrate compliance with the principles. Suitable records may include records of processing activities, reasoned legal bases, contracts, privacy information, DPIAs and safeguard assessments. What matters is whether they reflect actual processing and show which decision was made on what basis.

Data protection authorities have investigative and corrective powers under Article 58 GDPR. Documentation should therefore be findable, understandable and current. The regulation creates no general certification obligation that would conclusively complete all a company's data protection work; responsibility remains with the controller and the other participants subject to duties.

Certification under Article 42 GDPR is voluntary and concerns processing operations against approved criteria. Under paragraph 4 it does not reduce statutory responsibility; paragraph 7 limits its term to a maximum of three years with possible renewal. An information security certificate is not automatically such a data protection certification.

The decision to report a personal data breach must be separately evidenced. Article 33 requires notification without undue delay and, where feasible, within 72 hours of awareness unless the risk exception applies. Documentation under paragraph 5 also covers unreported breaches; communication under Article 34 follows its own risk threshold and exceptions.

ISO 27001 supports information security organisation but does not replace examining legal bases and data subject rights. NIS2 has its own addressees and reporting duties; an incident may require separate assessments under both legal frameworks. The EU AI Act adds requirements for certain AI systems without replacing data protection assessment of personal data processing.

Secani provides a data protection profile for roles, processing context and transfers, alongside an editorial GDPR assessment catalogue. The profile records company information and supports structured stocktaking. Professional assessment of actual processing and its lawfulness remains a separate task; the profile is neither regulatory approval nor an automatic legal assessment.

Start with a clearly defined processing activity, such as handling support requests. Describe purpose, data, data subjects, services involved and recipients, and examine the appropriate legal basis with the responsible specialists. Then record which safeguards and procedures for rights and incidents are actually needed.