GDPR

Regulation (EU) 2016/679 needs no introduction. What is worth being precise about is which part of it this product answers, because GDPR is much wider than any GRC tool.

What the framework covers

Adopting GDPR in Vendorica scaffolds controls for the technical and organisational measures surface: Articles 5(1)(f), 24, 25, 28, 30, 32, 33, 34, 35(7)(c)–(d), 36 and 37, plus the EDPB material on Article 25 and international transfers.

In plainer terms: security of processing, processor due diligence, records, breach notification, data protection by design, and the DPO. These are the obligations that behave like controls — they have owners, they produce evidence, and an auditor tests them.

The rights and assessment procedures are elsewhere, deliberately

Data-subject rights (Arts. 12–22), the DPIA procedure (Art. 35) and the full record of processing are workflows, not controls, and they live in the Privacy add-on as the ROPA register, the DPIA workflow and the DSAR inbox — each with its own lifecycle and its own deadlines. Adopting the GDPR framework does not turn those on, and a control set is not a substitute for them. Availability differs by plan; see vendorica.com/pricing.

Article 32 in practice

Article 32 asks for measures appropriate to the risk, and names four: pseudonymisation and encryption; ongoing confidentiality, integrity, availability and resilience; restoration after an incident; and a process for regularly testing and evaluating effectiveness.

That last one is the clause people forget, and it is the one Vendorica is best at: a control with an automated test and dated evidence is a regular evaluation of effectiveness, and the register of test results is the record that it happened. See Working with controls.

Article 28 — your processors

Every processor you use needs a contract carrying Article 28(3)’s terms, and you must use only processors giving sufficient guarantees. That is the vendor register doing its normal job:

• The contract carries the DPA and its terms — see Recording a contract.
• The assessment is the sufficient-guarantees test, sized to what the processor handles — see Assessing a vendor.
• Sub-processors are the fourth parties in your register. Article 28(2) makes their engagement your business, and the chain is already modelled.
• Transfers outside the EEA are a country field on the vendor and a term in the contract, and both are reportable.

Breach notification

Article 33 gives you 72 hours from becoming aware to notify your supervisory authority, and Article 34 adds communication to data subjects where the risk is high. Log the event in Incidents as soon as you know about it — the created timestamp is what “became aware” means later, and it is much easier to have recorded it than to argue it.

A personal-data breach and an ICT incident are not the same event

They overlap and they are reported to different authorities on different clocks. An incident can be one, both or neither, and if you are also in scope for DORA or NIS2, assume you are running more than one deadline from the same moment.