Art.24 Responsibility of the controller
Implement appropriate technical and organisational measures to ensure, and to be able to demonstrate, that processing is performed in accordance with the Regulation, taking into account the nature, scope, context and pur
5
artefacts
1
held by a system
2
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Assurance output such as internal audit, control testing or DPO reporting that demonstrates rather than asserts compliance · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
- The risk assessment that drove the choice of measures, referencing nature, scope, context, purposes and risk to individuals · Policy repository / GRC workspace
- The assignment of data protection responsibilities across the organisation, and evidence the assignees act on them · Policy repository / GRC workspace
governing documentDocuments that govern the control
- The data protection policy set, each with an approval authority, an effective date and a review cycle · Policy repository / GRC workspace
- Review records showing the measures were reassessed and updated after material changes to the processing · Document repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Policy repository / GRC workspace on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- A policy suite adopted once and never reviewed, so it describes processing the organisation no longer carries out
- Measures selected from a generic checklist with no link to the risk this organisation's own processing presents
- Accountability documentation that records what should happen with no evidence that it does
- Certification or code adherence presented as the whole of compliance rather than as one element of it
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.22 Automated individual decision-making, including profiling · Art.25 Data protection by design and by default