Get audit-ready for GDPR
EU GDPR · General Data Protection Regulation
EU regulation on data protection and privacy for individuals within the European Union and European Economic Area.
GDPRWhat is GDPR?
EU regulation on data protection and privacy for individuals within the European Union and European Economic Area.
Who it applies to
Any organisation processing the personal data of people in the EU, wherever that organisation is established. Territorial scope follows the data subject, not the company address, which is why Indian suppliers are routinely in scope.
How the standard is organised
A regulation of articles and recitals rather than a control catalogue. Obligations attach to roles - controller and processor - and to principles such as lawfulness, purpose limitation and data minimisation.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
GDPR on the Bitkosh platform
The 54 GDPR controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- Art.89Safeguards for archiving, scientific/historical research and statistical purposes
Sets additional safeguards, e.g. pseudonymisation and data minimisation, permitting derogations from certain data subject rights for archiving, research, and statistical purposes (Recitals 156–163).
Specific Processing Situations - Art.27Representatives of controllers not established in the Union
Non-EU controllers/processors that offer goods or services to, or monitor, EU data subjects must designate an EU representative (Recital 80).
Accountability - Art.22Automated decision-making, including profiling
Data subjects have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Recitals 71, 72).
Data Subject Rights - Art.48Transfers or disclosures not authorised by Union law
A foreign court or authority's judgment/decision requiring transfer or disclosure is only recognised or enforceable if based on an international agreement, e.g. an MLAT (Recital 115).
International Transfers - Art.11Processing which does not require identification
Controllers are not obliged to acquire or retain additional identifying information solely to comply with the GDPR (Recital 57).
Lawfulness & Transparency - Art.19Notification obligation — rectification/erasure/restriction
Controllers must notify every recipient of the personal data of any rectification, erasure, or restriction, unless this proves impossible or disproportionate (Recital 66).
Data Subject Rights
More privacy & data protection frameworks
Frequently Asked Questions
Who publishes GDPR, and who does it apply to?
How is GDPR conformance demonstrated?
How is GDPR structured?
Ready to get audit-ready for GDPR?
See how the Bitkosh Readiness Platform gets you audit-ready for GDPR — and the other 47 ready frameworks — from a single control library.