GDPR: the evidence behind every control

40 controls. For each, the artefacts auditors ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

Chapter II - Principles

Art.5Principles relating to processing of personal data hard Art.6Lawfulness of processing hard Art.7Conditions for consent hard Art.8Conditions applicable to child's consent hard Art.9Processing of special categories of personal data hard Art.10Processing of personal data relating to criminal convictions hard Art.11Processing which does not require identification hard

Chapter III - Rights of the Data Subject

Art.12Transparent information, communication and modalities for rights hard Art.13Information to be provided where personal data are collected moderate Art.14Information where personal data have not been obtained from the data subject hard Art.15Right of access by the data subject hard Art.16Right to rectification easy Art.17Right to erasure (right to be forgotten) moderate Art.18Right to restriction of processing hard Art.19Notification obligation regarding rectification, erasure or restriction hard Art.20Right to data portability easy Art.21Right to object hard Art.22Automated individual decision-making, including profiling hard

Chapter IV - Controller and Processor

Art.24Responsibility of the controller hard Art.25Data protection by design and by default moderate Art.26Joint controllers hard Art.27Representatives of controllers or processors not established in the Union hard Art.28Processor hard Art.29Processing under the authority of the controller or processor hard Art.30Records of processing activities hard Art.31Cooperation with the supervisory authority hard Art.32Security of processing hard Art.33Notification of a personal data breach to the supervisory authority hard Art.34Communication of a personal data breach to the data subject hard Art.35Data protection impact assessment hard Art.36Prior consultation hard Art.37Designation of the data protection officer hard Art.38Position of the data protection officer hard Art.39Tasks of the data protection officer hard

Chapter V - Transfers of Personal Data

Art.44General principle for transfers hard Art.45Transfers on the basis of an adequacy decision moderate Art.46Transfers subject to appropriate safeguards hard Art.47Binding corporate rules moderate Art.48Transfers or disclosures not authorised by Union law hard Art.49Derogations for specific situations hard