Openlane
GDPR logo

GDPR compliance

Keep processing records, Article 32 security controls, and processor agreements in one place, so accountability is something you can show rather than assert.

No credit card. 30-day free trial.

Accountability with an owner and evidence behind it

Every processor, every Article 32 control, and every policy attestation carries an owner and evidence, on a record a supervisory authority could read.

Processor and subprocessor records

Keep every processor in the vendor registry with its data processing agreement, the countries it processes data in, and its review history. If you publish a trust center, the public subprocessor list comes from the same records.

  • DPA and renewal dates on each vendor record
  • Subprocessor list sourced from the registry

Records of processing activities

Document each processing activity Article 30 asks for, with its purpose, data categories, retention period, and recipients, on the systems and platforms in your registry.

  • Processing activities on the system record
  • Retention periods documented

Security of processing

Write the controls behind Article 32, from access control to encryption and resilience, with an owner and evidence on each. Map them to ISO 27001 and SOC 2 where the same control serves.

  • Article 32 controls with evidence
  • Mapped to ISO 27001 and SOC 2

Data protection impact assessments

Record high-risk processing as risks, score them by impact and likelihood, and keep the mitigation decisions and their rationale where a DPO can review them.

  • Risks scored by impact and likelihood
  • Mitigation decisions kept with their rationale

Breach procedures

Keep incident procedures for the 72-hour supervisory authority notification as policies, and track each incident, its risk assessment, and its notifications with owners and dates.

  • Incident records with dates and owners
  • Procedures linked to their controls

Policy attestation

Publish privacy and data protection policies, link each to the controls it directs, and run recurring attestation campaigns so every person in scope has read the current version.

  • Policies linked to controls
  • Recurring attestation campaigns
Part of Compliance

Keep your processing records current

Put your processors, controls, and policy attestations where a supervisory authority could read them.

Request a Framework

No credit card. 30-day free trial.

Frequently asked questions

GDPR basics

What is GDPR?

The General Data Protection Regulation, Regulation (EU) 2016/679, is the EU's data protection law, in force since May 2018. It governs how organizations collect, use, store, and protect the personal data of people in the EU, and gives supervisory authorities the power to fine organizations that fall short.

Who needs to comply with GDPR?

Any organization that processes personal data of people in the EU, wherever the organization is located. That includes EU-based companies, businesses outside the EU offering goods or services to people in the EU or monitoring their behavior, and processors handling EU personal data on a controller's behalf.

What is personal data under GDPR?

Personal data is any information relating to an identified or identifiable natural person: names, email addresses, IP addresses, location data, online identifiers, and more. Special categories, such as health, biometric, and genetic data or data revealing racial or ethnic origin, religion, or political opinions, carry extra conditions.

What is the difference between a data controller and a processor?

A controller decides why and how personal data is processed. A processor processes it on the controller's behalf. Controllers carry primary responsibility for compliance, but processors have direct obligations of their own, and Article 28 requires a written contract between the two.

Rights and obligations

What are data subject rights under GDPR?

Individuals have the right to access their data, to rectification, to erasure, to restriction of processing, to data portability, to object, and rights concerning automated decision-making. Under Article 12(3), you must respond within one month of receiving a request, extendable by two further months for complex or numerous requests.

What are Records of Processing Activities (ROPA)?

Article 30 requires controllers and processors to keep records of their processing activities: the purposes, the categories of data subjects and personal data, the recipients, retention periods, international transfers, and a description of the security measures. Supervisory authorities can ask to see them.

When is a Data Protection Impact Assessment (DPIA) required?

A DPIA is required when processing is likely to result in a high risk to people's rights and freedoms, such as systematic monitoring, large-scale processing of special category data, or automated decisions with legal effects. It documents the risks and the measures that address them.

What are the breach notification requirements?

Under Article 33, you must notify the supervisory authority within 72 hours of becoming aware of a personal data breach unless it is unlikely to result in a risk to individuals. Under Article 34, if the breach is likely to result in a high risk, you must also inform the affected people without undue delay.

Openlane for GDPR

How does Openlane help with GDPR compliance?

Openlane keeps your processing records, the security controls behind Article 32, and every processor agreement on one record. Each control carries an owner and evidence, so the accountability principle in Article 5(2) is something you can show a supervisory authority.

How does Openlane handle processors and subprocessors?

Each processor lives in the vendor registry with its data processing agreement, the countries it processes data in, and a review schedule, which is the record Article 28 asks you to keep. If you publish a trust center, your public subprocessor list is built from the same vendor records instead of a second spreadsheet.

Does Openlane support international data transfers?

Openlane records, for each processor, where it processes data and which agreement covers the transfer, so the Chapter V picture is visible on the vendor record. The transfer mechanism you rely on, such as an adequacy decision or standard contractual clauses, is a legal decision you document; Openlane keeps it with the vendor it applies to.

© Copyright theopenlane, Inc. All Rights Reserved.

Openlane on Product Hunt
California Consumer Privacy Act (CCPA) Opt-Out IconYour Privacy ChoicesNotice at Collection