GDPR and data protection
Keep the record of processing, DPIAs, processors, data subject requests and breaches as linked records, so accountability can be shown at any time.
Typical requirementsGDPR (EU) 2016/679Personal Data Processing Law (Latvia)ISO/IEC 27701ISO 27001
Who it is forAny organisation that processes personal data in the EU, as controller or processor, and its data protection officer.
The GDPR asks controllers not only to comply but to be able to show it. That means a current record of processing, a legal basis per purpose, DPIAs for high-risk processing, processor agreements, a working process for data subject requests and breach notification, and security measures appropriate to the risk. In Latvia, the Personal Data Processing Law complements the GDPR and the Data State Inspectorate supervises it.
In WINGMAN, processing activities are assets, so they link to the same systems, suppliers, risks and controls as the rest of the information security programme. The DPO works from the same records as the security team, and the measures that meet ISO 27001 also show up as GDPR measures.
Videos
Plays from youtube-nocookie.com. YouTube sets no cookies until you press play.
Registers WINGMAN keeps
Each register is a set of linked records in one model, not a separate spreadsheet. Pick an entity to see it in the data model.
Record of processing activities
Processing activities with purpose, categories of data and data subjects, recipients, retention, systems and owner.
Processor and recipient register
Processors and sub-processors with agreements, locations, transfer safeguards and assessment dates.
DPIAs, notices and assessments
DPIAs, legitimate interest assessments, privacy notices and data processing agreements, linked to the activities they cover.
Privacy risks
Risks to the rights and freedoms of data subjects per activity, on the same scale as the rest of the register.
Breach register
Every personal data breach with assessment, notification decision, notices sent and follow-up, including those not notified.
Data subject requests
Access, erasure, rectification and objection requests with their deadline, owner and outcome.
Technical and organisational measures
Security and privacy measures (Art. 32) with owners and evidence, shared with ISO 27001.
The governance cycle on the model
Step through how the regulation runs on WINGMAN records, from scope to proof.
Screens for this stage · Stage 5: Requests and breaches
GIF
Use cases from this angle
The same use cases, with what changes for this regulation.
Compliance
GDPR and DPIA
The core of this angle. The record of processing and DPIAs, with risks and measures per activity.
Operations
Supplier evaluation
Processors are assessed before use, with data processing agreements and transfer safeguards kept on the supplier.
Operations
Incident handling
Personal data breaches follow the 72-hour notification decision, with the assessment kept even when nothing is notified.
Operations
Change management
A new purpose, system or processor triggers privacy by design and a DPIA screening before go-live.
Operations
Regular reviews
The record of processing, retention and processor agreements are reviewed on schedule.
Accountability
Roles and RACI
Controller, processor and DPO duties sit with roles, with the DPO's independence visible.
Assurance
Auditing
Data protection audits per article and per processing activity, with findings tracked to closure.
Compliance
New requirements
New guidance from supervisory authorities and the EDPB is mapped to existing measures.
Questions it answers
Where do we process this person's data?
From the data subject category to the processing activities, to the systems and processors that hold the data. That answers access and erasure requests.
Does this breach need to be notified, and by when?
From the breach to the activities and data affected and the risks to people, with the 72-hour deadline and the decision recorded.
Which processors receive personal data outside the EEA?
From the processor to its locations and sub-processors, with the transfer safeguard on file or missing.
Which high-risk activities have no DPIA?
Processing activities flagged as high risk with no linked DPIA show up as gaps.
Other sectors and regulations
NIS2 and national cybersecurity law
Run the information security office of an essential or important entity from one registry of suppliers, assets, risks, incidents, vulnerabilities, threats and tasks.
Financial sector – DORA, MiCA and supervisory expectations
Run operational, financial, reputational and other non-financial risk management on one model, and catch the events that should move it.
ISO 27001 and SOC 2 Type 2
Keep the whole ISMS in one model, with control ownership, recurring reviews, management review and evidence that holds up over an audit period.
AI governance – ISO 42001, EN 18286 and the EU AI Act
Treat each AI use case as an asset with its own risks, controls and work plan, and show conformity with the EU AI Act from the same records.
Cyber Resilience Act
Design CRA compliance into how products are built and supported, from risk assessment and SBOM to vulnerability handling and reporting.