GDPR: How to Achieve and Maintain Personal Data Compliance
Regulation (EU) 2016/679, known as the General Data Protection Regulation, imposes four core obligations on any data controller established in the EU or processing data of EU residents: maintain a record of processing activities (Article 30), conduct Data Protection Impact Assessments for high-risk processing (Article 35), respond to data subject rights requests within statutory deadlines (Articles 12 to 22), and appoint a Data Protection Officer where required (Article 37). Compliance is an ongoing process, not a one-time project. Each obligation requires documented evidence: a supervisory authority, such as the CNIL in France or the ICO in the United Kingdom, may ask for proof at any point. A data controller that cannot produce up-to-date records, completed DPIAs, and logged rights requests is exposed to enforcement action under Article 83 of the Regulation. Optivalue.ai provides the structure to collect, verify and maintain this evidence continuously.
Records of Processing Activities: How to Maintain Them
The Record of Processing Activities (RPA) is the central document of any GDPR compliance programme. Article 30 of the Regulation requires each controller to list every processing operation, the lawful basis for each, the categories of data subjects and data, the recipients, the retention periods, and the transfers to third countries. The record is not optional for organisations above the threshold set in Article 30(5): any organisation processing personal data other than occasionally, or processing special categories of data, must maintain it. A named owner must be assigned to each processing entry. Optivalue.ai guides each owner through a structured questionnaire and flags entries that lack a lawful basis or a documented retention schedule.
Data Protection Impact Assessment: When and How to Conduct One
A DPIA is mandatory before any processing that is likely to result in a high risk to the rights of individuals (Article 35 of the Regulation). The European Data Protection Board has published a list of processing operations that always require a DPIA, including large-scale profiling, systematic monitoring of publicly accessible areas, and processing of special categories of data at scale. The DPIA must describe the processing, assess its necessity and proportionality, identify risks, and document the measures taken to address each risk. A named reviewer must validate the assessment. If a residual risk remains high after mitigation, the controller must consult its supervisory authority before proceeding (Article 36). Optivalue.ai provides a DPIA template aligned with EDPB guidelines and tracks the status of each assessment against the processing entries in the RPA.
Data Subject Rights: How to Handle Them Within Statutory Deadlines
Articles 12 to 22 of the Regulation give individuals the right to access their data, rectify it, erase it, restrict its processing, and obtain its portability. Article 12 sets a one-month response deadline, extendable to two months for complex requests, with mandatory notification to the requester if an extension is needed. Every request must be logged, assigned to a named handler, and resolved within the applicable deadline. Failure to respond within the statutory period exposes the controller to a complaint to the supervisory authority. Optivalue.ai assigns each incoming request to a named owner, tracks the deadline, and produces an exportable log that demonstrates timely processing.
How GDPR Management Software Structures Each Obligation
A compliant GDPR programme depends on three things: a structured RPA that is kept up to date, a DPIA process that is triggered automatically when a new processing entry meets the criteria, and a rights-request log with audit trail. A spreadsheet can hold the RPA for a small organisation with stable, limited processing; it becomes inadequate when processing entries are numerous, when several entities share a single record, or when transfers outside the EU need individual documentation. Optivalue.ai provides a single workspace for each obligation, connects the DPIA to the relevant RPA entry, and produces the evidence package that a data subject or a supervisory authority would request. For conflict-of-interest declarations that contain personal data under GDPR, the platform applies the same evidence logic. For organisations required to set up an internal reporting channel required under GDPR for certain processing, Optivalue.ai covers that obligation within the same compliance workspace.
Book a demonstration with Optivalue.ai
FAQ
What is the difference between a data controller and a data processor under GDPR?
A data controller, as defined in Article 4(7) of Regulation (EU) 2016/679, determines the purposes and means of processing personal data. A data processor processes data on behalf of the controller. The obligations in Article 30 apply to both; the DPIA obligation applies to the controller. A processor must be bound by a data processing agreement (Article 28) that specifies the subject matter, duration, nature and purpose of the processing. The controller remains responsible for ensuring that the processor provides sufficient guarantees.
Which organisations must appoint a Data Protection Officer?
Article 37 of the Regulation requires the appointment of a DPO in three situations: when the controller is a public authority or body (other than courts); when the core activities consist of large-scale, regular and systematic monitoring of individuals; or when the core activities involve large-scale processing of special categories of data under Article 9 or data relating to criminal convictions under Article 10. An organisation may also appoint a DPO voluntarily. The DPO must be reachable by data subjects and by the supervisory authority.
When is a DPIA mandatory?
A DPIA is mandatory under Article 35 of Regulation (EU) 2016/679 when processing is likely to result in a high risk to the rights and freedoms of individuals. The European Data Protection Board (EDPB) guidelines on DPIAs identify nine criteria to assess likelihood of high risk, including evaluation or scoring, automated decision-making with legal effects, systematic monitoring, sensitive data, large-scale processing, matching or combining datasets, data concerning vulnerable persons, innovative use of technology, and processing that prevents individuals from exercising a right or using a service.
What are the GDPR deadlines for responding to data subject rights requests?
Article 12 of Regulation (EU) 2016/679 sets a one-month deadline from receipt of the request. This period is extendable by two further months where the request is complex or numerous, provided the controller notifies the data subject within the initial month of the extension and the reasons for it. Failure to respond within the deadline is itself a breach that the data subject may refer to the supervisory authority, independently of any underlying substantive breach.
What penalties apply for GDPR violations?
Article 83 of Regulation (EU) 2016/679 establishes two tiers of administrative fines. Violations of core obligations, including the principles of processing, the lawful basis, and data subject rights, may attract fines up to the higher of 20 million euros or four per cent of total worldwide annual turnover. Violations of more procedural obligations, including the RPA and DPO appointment requirements, may attract fines up to the higher of 10 million euros or two per cent of turnover. The actual fine depends on the nature, gravity and duration of the infringement and the cooperation of the controller.
Back to top
On the same topic