General Data Protection Regulation

You determine the purposes and means of processing personal data. In plain English: you decide why and how personal data gets used. If you're the one who said 'let's collect email addresses for our newsletter', congratulations — you're a controller.

Your obligations

• Establish a lawful basis for every processing activity (Art. 6) — 'because we can' is not one of them
• Maintain a Record of Processing Activities (RoPA) that documents what you process and why (Art. 30)
• Conduct Data Protection Impact Assessments (DPIAs) for high-risk processing — like profiling or large-scale monitoring (Art. 35)
• Report personal data breaches to your supervisory authority within 72 hours (Art. 33) — weekends and holidays included
• Ensure data subjects can exercise their rights: access, rectification, erasure ('right to be forgotten'), portability, and objection (Art. 15–22)
• Implement appropriate technical and organisational measures to ensure data security (Art. 32) — a Post-it note with the database password does not qualify
• Appoint a Data Protection Officer (DPO) if required (Art. 37)
• Only engage processors that provide sufficient guarantees — and formalise this in a Data Processing Agreement (Art. 28)

Key articles

You process personal data on behalf of a controller. Think: cloud hosting provider, payroll service, email marketing platform. You don't decide what to do with the data — you just do what the controller tells you. Like a very well-paid assistant with strict instructions.

Your obligations

• Only process data according to the controller's documented instructions (Art. 28) — freelancing with personal data is not appreciated
• Maintain your own Record of Processing Activities (Art. 30.2)
• Implement appropriate security measures (Art. 32)
• Notify the controller without undue delay if you discover a breach (Art. 33.2) — 'I was on holiday' is not undue delay
• Assist the controller with DPIAs and data subject requests when asked (Art. 28.3)
• Only engage sub-processors with the controller's prior authorisation (Art. 28.2)
• Delete or return all personal data when the processing relationship ends (Art. 28.3g)

Key articles

You're the organisation's independent data protection expert. You advise, monitor compliance, and serve as the contact point for the supervisory authority. You report directly to the highest management level, and no one can tell you what to conclude. You're essentially the auditor of data protection — nobody's favourite person at parties, but everyone calls you when things go wrong.

Your obligations

• Inform and advise the controller/processor on their GDPR obligations (Art. 39.1a)
• Monitor compliance with GDPR and internal data protection policies (Art. 39.1b)
• Advise on DPIAs and monitor their performance (Art. 39.1c)
• Act as the contact point for the supervisory authority (Art. 39.1d–e)
• Ensure your independence — you must not receive instructions regarding how to perform your tasks (Art. 38.3)
• Maintain expert knowledge of data protection law and practices (Art. 37.5)
• Be available for data subjects who want to raise concerns (Art. 38.4)

Key articles

You're a living, breathing human being whose personal data is being processed. That's it — no certification required. If an organisation has your name, email, IP address, or even your cookie preferences, you're a data subject. Which means you have rights. Quite a few, actually.

Your obligations

• You have the right to access your personal data and get a copy (Art. 15) — ask nicely, but you don't have to
• You can request rectification of inaccurate data (Art. 16) — your name is not 'Valued Customer'
• You can request erasure of your data — the famous 'right to be forgotten' (Art. 17)
• You can restrict processing in certain situations (Art. 18)
• You have the right to data portability — take your data and move it elsewhere (Art. 20)
• You can object to processing, including profiling and direct marketing (Art. 21) — yes, you can unsubscribe
• You have the right not to be subject to solely automated decision-making, including profiling (Art. 22)
• You can lodge a complaint with a supervisory authority if your rights are violated (Art. 77)

Key articles

Available tools

• Record of Processing Activities (RoPA) — document every processing activity with built-in templates
• DPIA with risk matrix — assess and score risks across 7 dimensions
• Incident management — track breaches with automated 72-hour deadline reminders
• Data subject rights — manage access, erasure, and portability requests end-to-end
• Consent management — track consent collection, withdrawal, and audit trails
• Data mapping — visualise data flows across systems and third parties
• Data Processing Agreements — manage processor relationships and sub-processors
• Legal basis assessment — document and review lawful basis per processing activity
• Transfer Impact Assessment (TIA) — evaluate international data transfers

AI-assisted features

• Consultation wizard (gdpr_readiness) — 5-step guided assessment with AI analysis per step and article references
• AI-generated compliance verdict: compliant / conditionally compliant / non-compliant
• Semantic search across GDPR articles, EDPB guidelines, and case law