GDPR: documents and measures, together
Records of processing, appointments, security measures and breach management, with technical evidence that comes from the scans and not from a self-declaration.
The GDPR applies to your company too
The General Data Protection Regulation (Regulation (EU) 2016/679) applies to anyone who processes personal data: customers, employees, suppliers, job applicants. There are no size thresholds that exempt a small business from the main obligations.
GDPR compliance is demonstrated in two ways: with documents (records, privacy notices, appointments, procedures) and with technical and organisational measures. Many companies have the former, written once and never updated, and no proof of the latter. That is exactly the part an inspection by the Garante (the Italian Data Protection Authority) or a data breach puts to the test.
The principle of accountability shifts the burden onto you: it is not enough to comply, you have to be able to prove it.
The main GDPR obligations
- Lawfulness, data minimisation and storage limitation
- Clear privacy notices to data subjects
- Records of processing activities (Article 30)
- Security measures appropriate to the risk (Article 32)
- Breach management, with notification to the Garante within 72 hours where required (Articles 33-34)
- Impact assessment when processing is likely to result in a high risk (Article 35)
- Instructions and authorisations for those who process the data
- Appointment of external processors
- Staff training
- The ability to demonstrate all of the above
Every GDPR obligation with its own tool
The GDPR self-assessment measures your starting point. From there, every requirement has a module that produces the document or the evidence.
| GDPR requirement | How Dottor Box covers it |
|---|---|
| Measuring the gap | GDPR gap analysis on coverage and maturity, with a score by function |
| Records of processing (Article 30) | Records of processing in the order of the article, with processing activities suggested by an analysis of the metadata in your Google Drive |
| Storage limitation | "Data to review in Google Drive" findings: CVs kept for more than 24 months, identity documents, payslips, health documents |
| Appointments, instructions, privacy notices | GDPR forms: personalised documents for employees and suppliers, in DOCX or PDF, in one step |
| Security measures (Article 32) | Vulnerability Assessment, system administrator access logs and the Microsoft Entra ID and Google Workspace cloud postures |
| Personal data breaches (Articles 33-34) | Incident Response and Data Breach: a breach register with the phases assigned to the CSIRT |
| Training | Training with an exportable record of courses, to show in the event of an inspection |
| Accountability | Compliance and GRC: the GDPR is one of the module's standards, with versioned procedures and evidence from the platform |
GDPR compliance you can demonstrate
Records that get themselves started
Processing activities suggested by the Drive scan, which reads only the metadata and never the content. Rows written by hand are never touched.
Appointments for everyone
Authorisation letters and privacy notices for all your staff, generated from the staff records in a single ZIP.
Article 32 backed by facts
Vulnerabilities managed, access tracked and cloud configurations verified: measures demonstrated by the scans, not stated in words.
Guided breach handling
When something goes wrong, the phases to follow are already there, each with its owner.
You do not comply with the GDPR through a binder written once: you comply by keeping up-to-date documents and verifiable measures together. That is exactly what the platform keeps aligned.
GDPR: frequently asked questions
Are records of processing mandatory for everyone?
Article 30 provides some exemptions for organisations with fewer than 250 employees, but they do not apply when the processing is not occasional, is likely to result in a risk or involves special categories of data. In practice almost every company has to keep them, and they remain the best tool for demonstrating accountability.
How soon must a personal data breach be notified?
To the supervisory authority, in Italy the Garante, within 72 hours of becoming aware of it, when the breach is likely to result in a risk to data subjects. The breach register must be kept in any case, even when notification is not required.
Does Dottor Box replace the DPO or the privacy consultant?
No. The platform produces documents, registers and technical evidence and keeps them up to date; legal assessments remain with those who have the expertise, within your organisation or among your advisers.
What security measures does Article 32 require?
The article does not give an exhaustive list: it requires measures appropriate to the risk, taking into account the state of the art and the costs. As examples it mentions pseudonymisation and encryption, the ability to ensure the confidentiality, integrity, availability and resilience of systems, the timely restoration of data after an incident and a process for regularly testing the effectiveness of the measures. That last one is the role of the vulnerability assessment.
When is it mandatory to appoint a DPO?
When the processing is carried out by a public authority or body, when the core activities consist of regular and systematic monitoring of data subjects on a large scale, or of large-scale processing of special categories of data or of data relating to criminal offences. In other cases it is optional. What a DPO is.
What fines does the GDPR provide for?
Up to 20 million euros or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements, such as those concerning the principles of processing or the rights of data subjects. Up to 10 million or 2% for others, including the obligations on security and breach notification. In deciding, the authority also considers the measures taken and the cooperation shown.
The modules that work for the GDPR
Records of processing
The GDPR Article 30 register, with processing activities suggested by an analysis of your Drive.
Learn more GovernGDPR forms
Appointments, privacy notices and authorisation letters for all your staff, generated in one step.
Learn more GovernIncident Response and Data Breach
CSIRT, incident handling phases and a breach register with notification deadlines.
Learn more SeeAccess logs
System administrator logins collected and retained as the Italian Data Protection Authority requires.
Learn more GovernTraining
E-learning for your staff, with a record of completed courses ready to show.
Learn more GovernCompliance and GRC
Policies, procedures, audits and evidence for eight frameworks: one piece of work that counts for several standards.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.