GDPR
The security and accountability articles, with verbatim public-domain text.
What GDPR is
The General Data Protection Regulation is EU law, directly applicable since May 2018, governing the processing of personal data of people in the EU regardless of where the processor is. It is not a security framework and does not read like one: it is a rights instrument, with security obligations attached.
The parts an operational compliance programme can actually track are the accountability and security articles — the Article 5 principles, the lawful-basis and consent conditions, the data-subject rights machinery in Chapter III, the controller and processor obligations in Chapter IV including records of processing, Article 32 security of processing, breach notification under Articles 33 and 34, data protection impact assessments, the DPO requirements, and the international transfer regime in Chapter V.
What GDPR conspicuously does not give you is a control list. Article 32 says "appropriate technical and organisational measures" and then names four examples. That vagueness is deliberate and it is why GDPR compliance evidence tends to live in a lawyer's memory rather than in a system.
Who it applies to
- Any organisation processing personal data of people in the EU or EEA, wherever the organisation is established.
- Processors as well as controllers — Article 28 obligations run down the chain, and a processor is directly liable for its own breaches.
- Organisations transferring personal data out of the EU, where Chapter V requires a documented transfer mechanism per flow.
- Anyone who has committed to GDPR terms in a customer data processing agreement, which in practice is most B2B software companies.
How it is structured in CMDash
CMDash seeds the key articles, grouped by the regulation's own chapter structure — principles, lawful basis, consent, special categories, data subject rights, controller and processor obligations, records, security, breach notification, impact assessment, DPO, international transfers, supervisory authority, enforcement, and technical measures.
| Principles | 7 |
| Lawful Basis | 1 |
| Consent | 2 |
| Special Categories | 2 |
| Data Subject Rights | 11 |
| Controller Obligations | 3 |
| Processor Obligations | 2 |
| Records | 1 |
| Security | 1 |
| Breach Notification | 2 |
| Impact Assessment | 2 |
| DPO | 3 |
| International Transfers | 5 |
| Supervisory Authority | 1 |
| Enforcement | 1 |
| Technical Measures | 4 |
These counts are the control rows CMDash actually seeds, checked against the seed files by a test on every build.
The control text
48 of the 48 seeded controls carry the publisher’s own wording, taken from Regulation (EU) 2016/679 (GDPR), consolidated text. It is public-domain content, so CMDash reproduces it rather than paraphrasing — you assess against what the publisher wrote.
What CMDash does for GDPR
- Verbatim article text from the consolidated GDPR, which is public-domain EU legislative content. You are assessing against what the regulation says rather than a vendor's paraphrase of it.
- Each article carries a practical evidence requirement — Article 5(2) accountability asks for the record of processing activities, the compliance programme documentation and the DPO appointment, not a restatement of the principle.
- A seeded crosswalk to NIST CSF, so the Article 32 security measures report alongside the rest of your security programme rather than in a parallel privacy silo.
- Dated evidence and reviewer workflow — which for GDPR mostly means DPIAs, transfer impact assessments, ROPA snapshots and consent-mechanism documentation staying attached to the obligation they satisfy.
- Every control is a tracked row with an owner, a status (not started, in progress, implemented, not applicable, at risk, failing), reviewer notes, and its own evidence requirements — not a checkbox on a spreadsheet.
- Evidence is uploaded against a specific control, dated, and kept on that control, so an assessor can see what was true when.
- Gaps export to a POA&M CSV — every control that is not implemented and not marked out of scope, with owner, status and evidence requirements.
- Policies you author in CMDash link to the controls they govern, so each control row shows which living policies stand behind it.
- A time-boxed, read-only external assessor seat can be scoped to just this framework, with an expiry date you set and a record of every page they opened.
What it shares with your other frameworks
CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artefact being gathered twice, and they are how a second framework costs a fraction of the first.
Where the evidence comes from
CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to GDPR’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.
Where CMDash stops
Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.
- This is the security and accountability slice, not the whole regulation. The recitals, the supervisory-authority procedural articles and the remedies-and-liability provisions are not modelled as assessable controls.
- CMDash does not perform data mapping, discovery or ROPA generation. It tracks the obligation and holds the artefact; it does not find personal data in your systems.
- No consent management platform is included, and none is implied.
- Nothing here is legal advice, and GDPR is a framework where the application of an obligation to your circumstances is genuinely a legal question.
Common questions
Can a tool make us GDPR compliant?
No, and a tool that says it can should worry you. GDPR compliance turns on lawful basis, purpose, necessity and proportionality — judgements about your business, not settings. What software can do is make the obligations explicit, keep the evidence attached to them, and stop the record of what you decided from living in one person's memory.
Is the article text really verbatim?
Yes. The consolidated GDPR text is public-domain EU legislative content, so it is reproduced rather than summarised. Evidence-requirement wording is CMDash's own.
Does this cover the UK GDPR or other national regimes?
Not separately. Only the EU regulation is seeded. The UK GDPR is substantially similar in substance but is a distinct instrument, and CMDash does not ship it as its own framework.
Also in Privacy & Sector Regulation
Paid plans cap how many frameworks you run at once, never which ones — GDPR is available on every paid plan.
View pricingReady to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.