Solutions · Data protection
As a data protection officer or data protection coordinator, your job is to advise and monitor, yet the documentation still ends up with you. Sightadel organises the record of processing activities, processing on behalf, technical measures, impact assessments and data breaches so that departments contribute and you can show the status at any time.
Starting point
The GDPR does not only require data to be processed lawfully. Under Art. 5(2), the controller must also be able to demonstrate compliance. In practice this means: an up-to-date record of processing activities, agreements with all processors, evidenced technical and organisational measures, documented impact assessments and a register of all data breaches, including those not reported.
Usually much of this exists, just not in one place. The record sits as a spreadsheet on a shared drive, the agreements with procurement, IT describes the technical measures in a separate document, and the ISMS has a second version of the same measures. When the supervisory authority makes enquiries or a customer sends a questionnaire, the search begins.
Then there is your particular position. As a data protection officer you advise and monitor; responsibility for implementation lies with management and the departments. Sightadel reflects exactly that: departments work on their parts themselves, you review and see where something is missing. As an external data protection officer you work with your own role in your client's account.
Why now
After a complaint or a data breach, the authority asks for the record, measures and agreements. The response deadline is short. If you have the status organised, you answer in days instead of weeks.
A misaddressed mailing, a lost notebook, an attack on a mailbox. Reportable breaches generally go to the supervisory authority within 72 hours. For that, the assessment, responsibilities and reporting channel must be set in advance.
A department wants to introduce a cloud tool. Before it goes live, it needs an entry in the record, a data processing agreement, a review of subprocessors and, if the risk is high, an impact assessment.
Employees use tools based on artificial intelligence, often without approval. This raises questions about the legal basis, transfers to third countries and impact assessments. An organised approval process replaces uncontrolled growth.
As a processor you constantly answer questionnaires on technical measures and subprocessors. A maintained status and a Trust Center answer the usual questions once for everyone.
The company introduces an ISMS under ISO 27001 or falls under NIS2. Now is the moment to maintain the technical measures jointly rather than twice.
Relevant frameworks
Summarised in our own words, not legal advice. The original text in its current version is authoritative.
Applies to every organisation that processes personal data, supplemented in Germany by the Federal Data Protection Act (BDSG). The core of the documentation is the record under Art. 30, agreements under Art. 28, the measures under Art. 32, impact assessments under Art. 35 and the documentation of data breaches under Art. 33. There is no general GDPR certificate; the supervisory authorities carry out the checks.
View framework →The technical and organisational measures under Art. 32 can be evidenced with the same evidence as many controls from Annex A, for example on access control, encryption, backups or suppliers. Annex A also contains its own control on protecting personal data. Legal bases and data subject rights have no equivalent in the standard.
View framework →If your company falls under the German BSI Act (BSIG), the incident process, access control and vendor management serve both sets of rules. A security incident can trigger a report to the Federal Office for Information Security (BSI) and to the data protection authority at the same time, with different deadlines and recipients.
View framework →Anyone using AI systems with personal data must consider the requirements of both sets of rules. Impact assessments, transparency towards data subjects and the assessment of providers can be handled together.
View framework →Recommended order
Existing records come into Sightadel via Excel import. For each processing activity, the purpose, legal basis, categories of data and persons, recipients, transfers and deletion periods are set. Departments add their entries, you review.
All service providers that process data on your behalf go into the vendor list with their agreement, subprocessors and evidence. Missing or outdated agreements become measures with a deadline.
The measures under Art. 32 are answered as questions and linked to evidence, such as the authorisation concept, encryption, backup test or training record. If there is an ISMS, you link the existing evidence instead of creating new evidence.
Guiding questions show where a data protection impact assessment is needed. The supervisory authorities have published lists of processing operations for this. The controller carries out the assessment itself with your advice; Sightadel provides structure and records the result.
Who assesses a data breach, who reports it, who notifies data subjects? Who answers access requests within the deadline? Responsibilities, deputies and templates are recorded and rehearsed once.
Follow-up reminders for the record, agreements and measures. Evidence carries an expiry date. New processing activities and service providers are added before they go live, not at the next audit.
Your role
The GDPR assigns advice and monitoring to the data protection officer. The obligations themselves fall on the controller. This separation should also be reflected in how you work.
HR, sales and IT know their processing activities best. With the Contributor role they maintain their entries in the record and upload evidence. You review and approve.
Processing without a deletion period, service providers without an agreement, measures without evidence. Open points appear as issues and action plans with an owner, not as a note in your calendar.
If you advise against a processing activity or recommend an impact assessment, this is recorded with a date in the activity log. If management decides otherwise, that is traceable too.
With the External Consultant role you work in each client's account. Every client has its own separate status, and the log notes that the access came from outside.
How Sightadel helps
The GDPR obligations are set out as guided questions, from the principles through data subject rights to the reporting obligation. Each question comes with an explanation, answer and evidence. You see at a glance where the documentation stands.
Learn more →Processors are tracked with country, agreement, subprocessors and evidence, including validity dates. You record which data a vendor processes. This determines its risk rating, and missing agreements stand out.
Learn more →Agreements, concepts, training records and impact assessments are kept with version and expiry date in the evidence archive. One piece of evidence on access control serves both the measures under Art. 32 and the matching ISO 27001 controls.
Learn more →Templates for the record of processing activities, privacy notices, deletion concept and replies to data subject requests, tailored to your industry. The AI helps with the wording. The legal assessment of each individual case stays with you.
Learn more →Missing agreements, open deletion periods or measures after a data breach become tasks with an owner and a deadline. Management sees overdue points on the dashboard without you having to report them one by one.
Learn more →Customers find your technical measures, the list of subprocessors and approved documents in one place. As a processor, this saves you many follow-up questions.
Learn more →Effort and duration
The ranges are based on experience, not a promise. The biggest factors are how well the departments cooperate and whether there is already an ISMS whose evidence can be reused.
What you license · typically Basic
For data protection alone, the Basic edition with five users and ten vendors is usually enough. If you are building an ISMS at the same time, add ISO 27001 and use the evidence for both. If ISO 27001 is included, there is a permanent discount on GDPR. With many processors, the Professional edition with 25 vendors is a better fit.
Licence per framework, minimum term one year, payable monthly or annually. You will find all prices, discounts and a calculator on the pricing page. Fees of a certification or audit body are charged separately.
Questions and answers
More in our FAQ or directly via our contact form.
In Germany, under § 38 of the Federal Data Protection Act (BDSG), generally when at least 20 people are constantly involved in the automated processing of personal data. Regardless of headcount, the obligation applies, for example, when processing requires an impact assessment, or under Art. 37 GDPR for certain core activities such as large-scale processing of health data. Clarify the classification in your individual case with your legal advisers.
Reportable breaches go to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of them. No report is needed if the breach is unlikely to result in a risk to the data subjects. If the risk is high, the data subjects are notified as well. Every breach is documented, even without a report.
In principle one month from receipt. For complex or numerous requests, the deadline can be extended by two further months, but the data subject must be informed of this within the first month. In Sightadel you record receipt, handling and response as evidence.
The measures under Art. 32 GDPR and many controls from Annex A cover the same topics, such as access, encryption, backups and suppliers. In Sightadel you link one piece of evidence to both. We deliberately do not give a figure for the overlap, because it depends on the scope.
Yes. Each client has its own account and invites you with the External Consultant role. The statuses stay separate, and the activity log notes that the access came from outside.
No. Sightadel provides structure, templates and an evidenced status. Questions on legal bases, balancing of interests or third-country transfers you assess yourself or with your legal advisers. For difficult cases, consulting can be added as a package in the app.
There is no general certificate confirming compliance with the GDPR. What you can show is organised, evidenced documentation in line with the accountability principle. Sightadel does not certify.
Sightadel is developed in Germany and operated in Germany. We conclude a data processing agreement under Art. 28 GDPR with every customer. Sightadel holds the documentation of your measures, not the personal data of your customers or employees.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
