Personal data protection
GDPR in practice: processing records, assessments, data subject rights and breaches
GDPR isn't evidenced by a published privacy policy. It's evidenced by an up-to-date record of processing, impact assessments for high-risk processing, answering rights requests on time, and documented breach handling.
Screens from DSA Compliance v6.2 in a demo environment. All data shown is fictitious.
What the rule requires, and in which article
For information only, not legal advice. Always check against the consolidated text in force.
Up to €20,000,000 or 4% of worldwide annual turnover (art. 83.5 GDPR). In Chile, Ley 21.719 sets fines of up to 20,000 UTM from December 2026.
The badges identify the obligation the program digitises. They are not certifications or conformity accreditations.
What gets handed over when somebody asks
- A record of processing exportable as the official register
- Impact assessments versioned and signed by the data protection officer
- A file for every right exercised, with identity verification and a sealed response
- A timeline of every breach with the 72-hour count
- A register of processors and their art. 28 contracts
This programme implements certifiable ISO standards. If your organisation already is, here you see which part is solved and which laws it covers in each country where you operate.
What we get asked about Data protection
When the processing is high risk: large-scale systematic monitoring, special category data, automated decisions with legal effects, or the cases on the Spanish DPA's list.
From when the controller becomes aware of the breach (art. 33.1 GDPR). That's why recording the time of detection matters, not just the time of the incident.
It follows the GDPR standard with its own agency, a different timetable and penalties denominated in UTM. The platform keeps both regimes mapped onto the same register.
A 30-minute guided demo on the real platform, or a one-hour assessment session with a consultant.
