GDPR compliance software

What it is

The GDPR is the EU General Data Protection Regulation. It took effect on 25 May 2018 and protects the personal data of people in the EU and the European Economic Area. It sets rules for how personal data is collected, used, shared, kept and deleted. Controllers decide why and how personal data is processed. Processors handle that data on a controller's instructions. The highest fines reach 20 million euros or 4% of global annual turnover, whichever is higher. Each supervisory authority in an EU member state enforces the rules in its country.

Who needs it

The GDPR applies to organisations that process personal data of people in the EU. It also reaches organisations outside the EU that offer goods or services to people there or monitor their behaviour. Controllers and processors both carry duties under the law. A processor must sign a contract with each controller it serves. Many websites fall in scope through cookies, analytics and tracking pixels that collect personal data, even when the business has no office in the EU. Public authorities must appoint a Data Protection Officer (DPO). So do organisations whose core activities involve large scale monitoring or special category data.

What auditors check

• A record of processing activities that lists each purpose, data category, recipient, transfer and retention period.
• A lawful basis recorded for each processing activity, chosen from the six bases in Article 6.
• A cookie banner that blocks every cookie and tracker not strictly needed until the visitor gives consent, with a refuse option on the same screen.
• A privacy notice that explains who processes the data, why, on what basis, for how long and which rights apply.
• A process that answers access, correction, erasure, restriction, portability and objection requests within one month of receipt.
• Data protection impact assessments for high risk processing, completed before that processing starts.
• Data processing agreements with every processor, setting out the duties in Article 28.
• Security measures that match the risk, such as encryption and access control, as Article 32 requires.
• A breach response plan that notifies the supervisory authority within 72 hours of becoming aware of a notifiable breach.
• Safeguards for international transfers, such as adequacy decisions or standard contractual clauses backed by a transfer risk assessment.
• A Data Protection Officer where Article 37 requires one, with contact details published for data subjects.
• Staff training on data protection duties, with records that show who completed it.

How Oncrypt gets you ready

Oncrypt builds your GDPR readiness around the places where personal data most often leaks out. Our scans check your website for cookie consent gaps and tracking pixels that fire before a visitor agrees. We also check your email and domain settings, your cloud accounts and the forms that collect personal data. Each finding lands in your score with a clear fix and an owner. Our in house pentest team tests the systems that matter most. Our compliance lead checks the evidence. Our team verifies each control before it counts as done. The evidence vault keeps each record ready for your DPO or your supervisory authority. No auditor can certify GDPR compliance in general, so Oncrypt does not issue a GDPR certificate. Oncrypt gives you GDPR readiness that our team has verified.

Overlap with other frameworks

Questions

Start with the gaps that matter most

Talk to us about your framework. We will show you what to fix first and what your auditor will ask for.