EU regulation · Data protection
Sightadel guides you through the obligations of the GDPR – from the record of processing activities through processing on behalf and technical measures to personal data breach notification. With industry templates drawn from years of consulting practice, AI as drafting help and real consultants for the difficult parts.
What it is about
The General Data Protection Regulation (GDPR) has applied directly throughout the EU since May 2018. In Germany, it is supplemented by the Federal Data Protection Act (BDSG). It governs the conditions under which personal data may be processed and the rights of the data subjects.
At its centre are the principles in Art. 5: lawfulness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality. On top of this comes accountability. You must not only ensure compliance but also be able to demonstrate it.
So the question is rarely whether the GDPR applies, but to what extent. Most organisations have records, contracts and measures lying around somewhere. The problem is their state: scattered, out of date and laborious to compile when the supervisory authority makes a request.
The record of processing activities dates from 2018, and the list of service providers is no longer correct. Sightadel turns this into a maintained state with scheduled reviews.
As a processor, you constantly answer questionnaires on technical measures and sub-processors. The Trust Center answers the usual questions once for everyone.
Technical and organisational measures are maintained twice, once for data protection and once for the ISMS. One piece of evidence can prove both.
Requirements
Summarised in our own words. The original text in its current version is always authoritative.
Every processing operation needs a legal basis and follows the principles. The controller implements appropriate measures and can demonstrate compliance with them.
In SightadelGuided questions on principles and legal bases. The assessment in each individual case remains with you and your data protection officer; Sightadel records it with a justification.
Information, access, rectification, erasure, restriction, data portability and objection – on time and traceable.
In SightadelControls on privacy notices, the process and deadlines for requests. Response templates are ready, and the handling is filed as evidence.
Data protection is taken into account as early as the planning and selection of systems, and default settings collect only what is necessary.
In SightadelControls for procurement and development, linked to your approval processes. Decisions are documented with date and owner.
Service providers that process data on your behalf are carefully selected and contractually bound; sub-processors are known.
In SightadelIn the Vendors module, you record service providers with contract, sub-processors and evidence including validity dates. Missing contracts become action items.
A record of all processing activities with purpose, categories of data and data subjects, recipients, transfers, erasure periods and measures.
In SightadelThe industry template suggests typical processing activities; you confirm, add or remove them. Scheduled reviews keep the record up to date.
Technical and organisational measures appropriate to the risk, with regular review of their effectiveness.
In SightadelMeasures as guided questions with evidence links. Evidence on access control or backup also proves requirements from ISO 27001 or NIS2.
Notifiable breaches are, as a rule, reported to the supervisory authority within 72 hours. Where the risk is high, the data subjects are also notified. Every breach is documented.
In SightadelReporting channel, responsible persons and assessment criteria are set up in advance. Breaches are recorded with time, assessment and measures, even when no notification was required.
For processing likely to result in a high risk, risks and remedial measures are assessed in advance.
In SightadelGuiding questions help you recognise where an impact assessment is needed. You carry out the assessment itself; Sightadel provides structure and records the result.
Where required, a data protection officer is designated, notified to the supervisory authority and involved at an early stage.
In SightadelDesignation, notification and involvement are kept as evidence. Internal or external data protection officers work in Sightadel with their own role.
Process
Two to four months for robust core documentation if someone in-house drives it. After that, data protection is an ongoing state, not a project with an end date.
Define responsibilities, upload existing documents and assign them to the 45 controls. At the end, you know what is documented and what is missing.
Record processing activities with purpose, legal basis, recipients and erasure periods. The business units contribute; the structure comes from the template.
Record processors, review contracts and sub-processors, create action items for gaps.
Document technical and organisational measures, assess high-risk processing, carry out an impact assessment where necessary.
Define procedures for data subject requests and personal data breaches, appoint responsible persons, run through them once.
Scheduled reviews for the record, contracts and measures. New processing activities and service providers are added before they go live.
Ready to start
Clarify these questions early and you save weeks later on. In Sightadel they are set up as your first tasks.
Division of work
If software filled everything in, the standard would not serve its purpose – and the auditor would notice. That is why it is clearly defined what stays with you.
From practice
From many years of consulting and certification practice: these are the points that cost the most time or lead to nonconformities in the audit.
New tools and processes are soon missing. Set a scheduled review and make the record a step in every procurement.
Small tools and trial accounts are often overlooked. Regularly reconcile the list of service providers with purchasing and IT.
Consent can be withdrawn and is often not the appropriate legal basis. For each processing activity, check which basis applies and document it.
An erasure concept that is never implemented is a finding. Schedule erasure runs and record that they have taken place.
Breaches that do not need to be notified must also be documented. Record each one with time, assessment and measures.
If you only work out where data is held when the first request arrives, you will miss the one-month deadline. Define responsibility, identity verification and approval in advance.
One piece of evidence, several frameworks
We deliberately do not give a percentage – it depends on your scope. Where requirements overlap, one piece of evidence is attached to all of them.
Technical and organisational measures under Art. 32 can be proven with the same evidence as many Annex A controls. Legal bases and data subject rights have no equivalent there.
NIS2Incident process, access control and vendor management serve both. A security incident can trigger reporting obligations to both the BSI and the data protection supervisory authority.
SOC 2The criteria on confidentiality and privacy draw on the same measures and service provider data. Helpful if you also supply US customers.
ISO 42001If you use AI with personal data, you assess risks for data subjects under both frameworks. The impact assessment and AI risk assessment can be run together.
Audit and evidence
Responsibility lies with the data protection supervisory authorities of the German federal states and, for certain areas, with the Federal Commissioner for Data Protection. They investigate complaints, request documents and can impose fines. In addition, there are customers who audit you as a processor, and internal or external data protection officers. Sightadel does not certify and does not provide legal advice.
Whoever audits receives their own access in Sightadel and can never delete anything. The activity log shows in full who did what and when, and in the Trust Center you show customers measures, documents and sub-processors. ISO 27001 is a proven, structured foundation for the technical measures, but it is not mandatory. For external audits, choose an auditor from our independent partner network or your own. No commission is paid for audits – neither to us nor to the partners.
To the independent auditor networkData protection incurs ongoing costs, not one-off ones. For the tool, the Sightadel licence for the GDPR is charged monthly per edition, with a minimum term of one year. If your Sightadel licence includes ISO 27001 or ISO 9001, you receive a permanent discount on the GDPR. You will find all prices and a calculator on our pricing page.
On top of that comes the data protection officer, if you must or want to designate one. They can be internal or external. An internal officer needs time, further training and enjoys special protection against dismissal, which must be taken into account in workforce planning. An external officer charges according to their own model. Both are independent of Sightadel.
The largest item is the internal effort for the core documentation: record of processing activities, contracts with service providers, technical and organisational measures, processes for data subject requests and personal data breaches. Two to four months is realistic if one person works on it regularly and the business units contribute. After that, it is about maintenance: adding new processing activities, reviewing contracts, implementing erasure periods, training employees. If you need support with individual questions, you can add consulting as a package in the app. Sightadel does not replace legal advice.
The GDPR has two ranges of fines: up to €10 million or 2% of worldwide annual turnover, for example for violations of obligations relating to security, the record of processing or processing on behalf, and up to €20 million or 4% for violations of principles, legal bases or data subject rights, whichever is higher in each case. Supervisory authorities set fines on a case-by-case basis and also take into account how cooperative and well prepared a company is.
Claims for compensation by data subjects are at least as relevant. They can also be asserted for non-material damage, for example after a data breach or a late response to an access request. In addition, there are orders from the supervisory authority that can restrict or prohibit processing, and cease-and-desist letters from competitors, whose admissibility is disputed in individual cases.
The core is accountability. You must not only work in compliance with data protection law but be able to prove it. In the event of a complaint, the supervisory authority asks about the record of processing, legal basis, contracts and measures. If you can present these documents quickly and consistently, you are in a much better position. That is exactly what the state of evidence in Sightadel is intended for.
The GDPR explicitly requires some documents: the record of processing activities, data processing agreements, documentation of personal data breaches, data protection impact assessments for processing likely to result in a high risk and, where necessary, the designation of the data protection officer. Others follow from accountability: a description of the technical and organisational measures, privacy notices, an erasure concept, evidence of consent, balancing tests for legitimate interest and training records.
The record is the backbone. For each processing activity, it describes the purpose, categories of data and data subjects, recipients, transfers to third countries, erasure periods and measures. If it is well maintained, privacy notices, the erasure concept and responses to access requests can be derived from it. If it is created once and then forgotten, after two years it describes a different organisation.
In Sightadel, the industry template suggests typical processing activities; you confirm, add or remove them. You maintain contracts and sub-processors in the Vendors module, and measures as guided questions with evidence. Scheduled reviews ensure the record is checked regularly.
Two processes determine whether data protection works day to day: handling requests from data subjects and handling personal data breaches. As a rule, you must respond to an access request within one month. For complex or numerous requests, an extension of up to two further months is possible if you give notice of this, with reasons, within the first period. The response covers the data itself, purposes, recipients, storage period and source, as well as a copy.
For this to work, it must be clear who receives requests, how identity is verified, where data is held and who approves the response. Requests often arrive through unexpected channels: to sales, via a contact form, as part of an employment dispute.
For personal data breaches, the 72-hour period starts when you become aware of the breach. Define who assesses whether there is a risk to data subjects, who reports and who informs the data subjects. If there is also a NIS2 incident, both reporting channels run in parallel. In Sightadel, responsible persons and templates are on record, and requests and breaches are recorded as evidence with time and assessment.
Hardly any organisation processes data only by itself. Payroll, email, CRM, ticketing, web analytics and hosting run with service providers. Each of them that processes data on your behalf needs a data processing agreement, and you must have selected them carefully. That includes knowing their measures and sub-processors.
Transfers to countries outside the European Economic Area deserve particular attention. They need a basis, such as an adequacy decision by the European Commission or standard contractual clauses with an assessment of the situation in the destination country. Even if a provider hosts in the EU, access from a third country may be possible, for example through support or a parent company.
In the Vendors module, you record service providers with contract, sub-processors, transfers and evidence including validity dates. Missing contracts become action items. Sightadel itself is developed in Germany and hosted in Germany, and every customer receives a data processing agreement under Art. 28 GDPR.
The GDPR requires security of processing but does not say in detail how. This is where an ISMS based on ISO 27001 helps: access control, encryption, backup, logging and incident handling are governed systematically there. The technical and organisational measures under Art. 32 can be proven with the same evidence. What ISO 27001 does not cover are legal bases, purpose limitation, data subject rights and the record of processing activities.
Entities subject to NIS2 use the incident process, vendor management and training for both frameworks. If you use AI with personal data, you assess risks for data subjects in the data protection impact assessment and, if introduced, in the impact assessment under ISO 42001. The two can be run together but do not replace each other.
In Sightadel, you link a piece of evidence once to all matching requirements. Your internal or external data protection officer works with their own role. In the Trust Center, you show customers measures, documents and sub-processors instead of filling in a new questionnaire for every request.
What it costs
You only pay for the frameworks you actually need. The editions differ in capacity and response time, not in subject-matter scope. If you run several frameworks, you save permanently. All prices, discounts and a calculator are on the pricing page.
The certification or audit body invoices its fees directly to you. If needed, you can add consulting as a package in the app.
Working materials
Checklists and templates for other frameworks are available under Resources.
Practical aids, not legal advice.
Terms
Almost always, as soon as you process data of customers, employees, applicants, suppliers or website visitors – regardless of size. The only exception is purely personal or household use. Individual obligations, such as designating a data protection officer, depend on further conditions.
Depending on the violation, up to €10 million or 2% of worldwide annual turnover, and for serious violations up to €20 million or 4%, whichever is higher in each case. On top of that come compensation claims by data subjects and orders from the supervisory authority.
Not a general one. The GDPR does provide for certification mechanisms that must be approved by the supervisory authority, but a certificate does not relieve you of responsibility. What counts is your documented state of evidence.
As a rule, a notifiable breach is reported to the supervisory authority within 72 hours of becoming aware of it. If there is a high risk to the data subjects, they must also be notified. You must document every breach, even if you do not report it.
No. Sightadel provides structure, templates and evidence management. The legal assessment in individual cases remains with your data protection officer or your legal advisers. Both can work directly in Sightadel with their own role.
Partly. The technical and organisational measures under Art. 32 overlap strongly with Annex A. Legal bases, purpose limitation, data subject rights, the record of processing activities and the impact assessment have no equivalent in ISO 27001.
Only as a draft. The AI suggests processing activities typical of your sector and helps with the wording. You decide on purposes, legal bases and erasure periods yourself – otherwise the record describes an organisation other than yours.
In Germany, generally when at least 20 people are regularly engaged in the automated processing of personal data. Regardless of headcount, the obligation applies, for example, to large-scale processing of special categories of data, systematic monitoring or where a data protection impact assessment is required. The officer can be internal or external.
As a rule, one month from receipt. For complex or numerous requests, an extension of up to two further months is possible. You must inform the data subject of this, with reasons, within the first month.
The Sightadel licence for the GDPR is charged monthly per edition; you will find all prices on our pricing page. On top of that may come an external data protection officer, who invoices independently, and your internal effort for core documentation and maintenance. If your licence includes ISO 27001 or ISO 9001, you receive a permanent discount on the GDPR.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
