Keep your GDPR accountability record in one system.
The GDPR applies to organizations established in the EU, and to those elsewhere that offer goods or services to people in the EU or monitor their behavior. Install it in Alvor and each article becomes a control with an owner and evidence, each asset records the purposes, legal basis, geographic scope and retention of the personal data it processes, and processors are assessed in Third-Party Risk Management.
GDPR overview
The regulation that redefined data privacy
4%
Max fine (global turnover)
72h
Breach notification deadline
99
Articles in the regulation
The GDPR applies to any organization that processes personal data of people in the EU, wherever the organization is based. It mandates specific rights for data subjects, strict breach notification timelines, and documented accountability for data processing. Non-compliance carries fines of up to 4% of annual global turnover or €20M, whichever is higher.
Domain coverage
What the GDPR asks of a controller
GDPR establishes comprehensive obligations around data processing, individual rights, organizational accountability, and cross-border transfers.
Lawful Basis & Consent
Document your lawful basis for each processing activity: consent, contract, legal obligation, vital interests, public task, or legitimate interests. Where consent is the basis, keep a record of it and of any withdrawal.
Data Subject Rights
Right of access, rectification, erasure, restriction, portability, objection, and automated decision-making. Each right requires documented processes and response timelines.
Data Protection by Design
Integrate data protection into processing activities from the design stage. Implement technical and organizational measures that enforce data minimization and purpose limitation.
Records of Processing
Maintain Article 30 records of processing activities: purposes, categories, recipients, transfers, retention periods, and security measures for every processing operation.
Data Protection Impact Assessments
Conduct DPIAs for processing likely to result in high risk. Document the assessment, necessity evaluation, risk mitigation measures, and supervisory authority consultation where required.
International Transfers
Document transfer mechanisms for personal data leaving the EEA: adequacy decisions, standard contractual clauses, binding corporate rules, or derogations under Article 49.
Common challenges
GDPR accountability requires documented evidence, not good intentions
The problem
Article 30 records of processing scattered across Word documents, spreadsheets, and tribal knowledge
How Alvor helps
Each asset's data-governance record holds the processing purposes, legal basis, geographic scope and retention of the personal data on it, beside its classification and owner, so you can show where personal data sits and why it is processed.
The problem
Data subject access requests arrive by email and you have no systematic process to answer them within one month
How Alvor helps
Write the request-handling procedure in Policy Management, approve and publish it, and record each handler's acknowledgement. The requests themselves run in your service desk or privacy tool, beside Alvor.
The problem
A breach occurs and you're not sure if you can meet the 72-hour notification requirement to your supervisory authority
How Alvor helps
Keep the breach procedure approved and acknowledged in Policy Management, and rehearse it as a tabletop exercise in Business Continuity. Each processor's contract records how many hours it has to tell you about an incident.
The problem
No documented DPIAs for high-risk processing activities that launched months ago
How Alvor helps
Review new processing as a Secure by Design project: its business impact analysis records data classification and privacy, the threat model follows the data flows, and four named people sign off before go-live.
What you get
GDPR accountability, documented
The GDPR in the framework library
Install the GDPR and each article becomes a control with an owner, an applicability decision, evidence with an expiry date, and audits whose findings become tasks or risks.
Privacy in every design review
Each new system or change is a Secure by Design project. Its business impact analysis records data classification and privacy, the threat model follows data flows across trust boundaries, and Business, Technical, Architect and Assurance sign off.
Personal data on the asset record
Each asset's data-governance record holds its data classification, the personal data types it carries, processing purposes, legal basis, geographic scope and retention, beside its owner and encryption status.
Processors through Third-Party Risk Management
A requester files a new processor before it is engaged, an analyst assesses it through the vendor portal, and the tier sets the reassessment schedule. The vendor record holds its DPA with the incident-notification window, and the sub-processors behind it with their countries.
Policies people have read
Publish the privacy policy and procedures through ordered approvals, and record each person's acknowledgement with time, IP address and session.
High-risk processing as a named risk
Record high-risk processing as a risk with likelihood and impact on your own scales, a treatment, and acceptance by a named person with conditions and an expiry.
Frequently asked
Common questions about GDPR
Practical answers for teams building privacy programs, responding to data subject requests, and preparing for supervisory authority scrutiny.
GDPR applies to any organization that processes personal data of individuals in the European Economic Area, regardless of where the organization is based. If you offer goods or services to people in the EU, or monitor their behavior, you are in scope. GDPR also applies transitively: if you are a data processor for an EU-facing customer, their obligations flow through to you via the data processing agreement.
Get started
See how Alvor works for your role
Whether you lead security, run IT, manage compliance, or sit in the C-suite - we'll show you your view.