Regulation (EU) 2016/679 — data protection

Nasıl doğrulanır

• A data processing agreement is on file for every processor and subprocessor, covering the Art 28(3) required terms, with subprocessor changes notified in advance

  DPA completeness against all of Art 28(3)(a)-(h) is a checklist a compliance expert should validate, not something inferred from the contract's existence alone.

Nasıl doğrulanır

• A written record of processing activities exists covering all of Art 30(1)(a)-(g), is kept current, and can be made available to the supervisory authority on request

  Whether the Art 30(5) small-organisation exemption applies is a legal judgement about the entity, not something the platform infers — in practice it rarely holds, because employee data is processed regularly.

Nasıl doğrulanır

• Breach assessed and notified to the supervisory authority within 72 hours of becoming aware, or a documented reason for delay

  Requires a timestamped incident register capturing time of awareness — not yet built (§3.15 Incident Management is Phase 3 scope).

Nasıl doğrulanır

• Affected data subjects are notified without undue delay whenever the breach risk assessment concludes 'high risk'

  Art 34(3) lists exemptions (e.g. the data was already encrypted, or a public communication is used instead) — not modelled as separate conditions yet; the risk assessment itself is a manual judgment call pending expert input.

Nasıl doğrulanır

• For each transfer with no adequacy decision, the unmodified standard contractual clauses are signed with the correct module, Annexes I to III are completed with real detail, and a Clause 14 transfer impact assessment is documented and kept current

  Whether the safeguard is actually effective in the destination country is a legal judgement about that country's law and practice — the platform can check the assessment exists and covers what Clause 14(b) requires, not whether its conclusion is right.