GDPR Chapter IV, Articles 24 to 31: controller responsibility, data protection by design and by default, joint controllers, EU representatives, processor contracts, instructions, records of processing and cooperation with supervisory authorities.
The general duty to implement risk-based technical and organizational measures and to be able to demonstrate compliance, including data protection policies and the role of codes of conduct and certification as evidence.
Building data protection principles into systems at design time and throughout operation, and privacy-protective defaults for collection, extent of processing, retention and accessibility. Applies to existing systems too.
When two or more parties jointly decide purposes and means: the arrangement that allocates responsibility for rights requests, notices, security and breaches, and the data subject's right to act against each controller.
The EU representative that non-EU controllers and processors caught by Article 3(2) must designate in writing: exemptions, where the representative sits, what it does, and what it does not change about liability.
Choosing processors with sufficient guarantees, the mandatory contract terms, sub-processor authorization and flow-down, and the Commission standard clauses that can be used. The legal core of vendor and hosting due diligence.
Staff, contractors and processors with access to personal data may process it only on the controller's instructions; how access control, confidentiality commitments and training make that enforceable.
The written record controllers and processors keep of their processing: required content, the processor version, availability to the supervisory authority, the under-250-employee exemption and its proposed widening.
The duty of controllers, processors and representatives to cooperate with the supervisory authority on request, the investigative powers behind it, and how cooperation affects fines.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.