GDPR

The GDPR governs how you handle personal data. It turns data protection into documented duties: a record of what you process, impact assessments for risky processing, a process for data-subject requests, breach notification on a fixed clock, and technical and organisational measures that protect the data itself. turingsecure helps you build and evidence the security side of those duties.

The Core Idea

Personal Data Comes With Documented Duties

The GDPR applies whenever you process personal data, meaning any information relating to an identifiable person. It does not just ask you to keep that data safe. It asks you to prove, on paper and in practice, that you know what you hold, why you hold it, and how you protect it with appropriate technical and organisational measures.

That proof is the heart of accountability under Article 5(2). Regulators, and the people whose data you process, can ask you to show it at any time. The obligations below are the concrete artifacts and processes that make up that proof.

Documented data-protection duties under the GDPR

Your Duties

What the GDPR Requires of You

Record of Processing (Art. 30): Keep a record of your processing activities: what personal data you process, for what purpose, who receives it, and how long you retain it.
Impact Assessment (Art. 35): Where processing is likely to result in a high risk to individuals, run a data-protection impact assessment before you start and document the safeguards you apply.
Data-Subject Requests: Answer requests for access, rectification, erasure and portability, usually within one month. People have the right to see and control the data you hold on them.
72-Hour Breach Notification: Notify the supervisory authority of a personal-data breach within 72 hours of becoming aware of it, and inform affected individuals when the risk to them is high.