GDPR control library
Every control CMDash tracks for GDPR, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.
Families
Principles · 7
| Art.5(1)(a) | Lawfulness, fairness and transparency |
| Art.5(1)(b) | Purpose limitation |
| Art.5(1)(c) | Data minimisation |
| Art.5(1)(d) | Accuracy |
| Art.5(1)(e) | Storage limitation |
| Art.5(1)(f) | Integrity and confidentiality Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.5(2) | Accountability Maps to NIST Cybersecurity Framework (1.1, legacy) |
Lawful Basis · 1
Consent · 2
Special Categories · 2
Data Subject Rights · 11
Controller Obligations · 3
| Art.24 | Responsibility of the controller |
| Art.25 | Data protection by design and by default Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.26 | Joint controllers |
Processor Obligations · 2
Records · 1
| Art.30 | Records of processing activities Maps to NIST Cybersecurity Framework (1.1, legacy) |
Security · 1
| Art.32 | Security of processing Maps to NIST Cybersecurity Framework (1.1, legacy) |
Breach Notification · 2
| Art.33 | Notification to supervisory authority Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.34 | Communication to data subjects |
Impact Assessment · 2
| Art.35 | Data protection impact assessment Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.36 | Prior consultation |
DPO · 3
International Transfers · 5
Enforcement · 1
Technical Measures · 4
| Art.32(1)(a) | Pseudonymisation and encryption of personal data Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.32(1)(b) | Confidentiality, integrity, availability and resilience Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.32(1)(c) | Ability to restore availability and access in timely manner Maps to NIST Cybersecurity Framework (1.1, legacy) |
| Art.32(1)(d) | Regular testing, assessing and evaluating effectiveness Maps to NIST Cybersecurity Framework (1.1, legacy) |
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for GDPR 2016/679, published from a build-time export rather than read from any customer’s workspace. Control text is quoted verbatim from Regulation (EU) 2016/679 (GDPR), consolidated text, which is in the public domain. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.