GDPR, kept as you work.

Requests that keep their own clock

Access, erasure and consent requests land in one queue, including through a public portal for data subjects. Each request carries its statutory deadline: a response without undue delay and at the latest within one month of receipt (Art. 12(3) GDPR).

• DSAR, erasure and consent queues
• Public request portal for data subjects
• Statutory clocks and audit trails

Records of processing that stay current

The Article 30 register is kept as part of the work rather than as a separate document, so it describes what the organisation actually does on the day someone asks.

Incidents, on one timeline

A personal data breach has to be notified to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people (Art. 33 GDPR). The security-incident workflow records every step, so the notification and its evidence come from the same place.

What an auditor sees

One control set mapped across GDPR, ISO 27001, ISO 37301 and NIS2, with an owner and evidence on each control. The same records feed the trust centre you publish to customers.