Description
Make your IT documentation fit for the GDPR
Step 1: Documentation and import of catalogues
The directory of processing activities required by the GDPR (Article 30) can be usefully integrated into existing IT documentation. The Data Privacy add-on extends i-doit with specific object types and categories to help you fulfil your documentation and accountability obligations. At the same time, threat and action catalogues provide you with risk management support.
Step 2: Recording the processing activities
The second step towards compliance with the GDPR is the recording of processing activities, data subjects, categories of data processed, etc. The risk management is based on the technical and organisational measures planned and implemented to protect the processing activities. The basis of risk management, in which technical and organisational measures for the protection of processing activities are planned and implemented, is the definition of protection needs.
Step 3: Gap analysis and optimisation process
In the last step, you can use the documentation to create gap analyses of existing declarations of consent, reports on information obligations and contracts with processors. In the case of discrepancies, you can initiate a continuous optimisation process. The change management and request fulfilment processes are also supported by corresponding i-doit add-ons.
Why you need the Data Privacy add-on
Data protection is already an important topic for all companies. In 2018, IT managers were faced with far-reaching changes: the new EU General Data Protection Regulation (EU GDPR) has been in force since the 25th of May 2018. This replaces some of the principles of data protection law under the old BDSG.
The GDPR provides for the obligation to keep a register of processing activities with clearly defined minimum requirements. In addition, further documentation obligations are provided for.
The Data Privacy add-on creates the structure to include the mandatory content according to Article 30 of the GDPR and also to document information that data controllers need to fulfil their accountability obligations according to Article 5(2).
