GDPR Activities
As part of its support for Regulation (EU) 2016/679 (GDPR), SeCube GRC assists organizations with the following data governance functions:
- Data processing activities and personal data inventory (Inventory)
- Data protection risk assessment (RISK)
- GDPR compliance assessment (Compliance)
- Data breach incident logging (Governance)
Record of Data Processing Activities
In Inventory, we can record data processing activities and categories of personal data (data sets) with the descriptive information required by the GDPR (e.g., legal basis, purpose limitation, deadline for erasure of personal data, etc.).
- Relationships: We can organize personal data sets and data processing activities into operational relationships—with visual representations of these relationships:
- which IT systems, databases, and services manage them,
- in which processes they appear,
- which third parties are involved in data processing
- Maintenance: Data maintenance responsibilities can be assigned to business unit managers. Review functions ensure periodic reviews of the Record of Data Processing Activities.
- Export capabilities: The Record of Data Processing Activities can be exported in both Word and Excel formats. The report includes:
- GDPR organizational data
- Complete record of data processing activities
- Record of categories of personal data processed
- List of IT systems, services, and third parties involved in the processing of personal data categories
Data Protection Compliance Assessment, Internal Audit
In the compliance module, by uploading customizable data protection requirement sets (GDPR and international NIST and ISO recommendations) or our own data protection requirements, we can conduct audits against our own requirements. To address audit deficiencies, you can create an action plan and track the implementation of corrective measures. In addition to reports, audit reports can be generated based on the assessments.
- Organizational data processing requirements of Regulation (EU) 2016/679 (GDPR)
- NIST Privacy Framework
- ISO/IEC 29151 (Protection of Personally Identifiable Information)
Data Protection Risk Analysis
A dedicated data protection risk analysis can also be initiated and maintained in the RISK module. The analysis is based on our record of data processing activities and their interrelationships (systems, personal data sets, processes). During the risk analysis, you can assess data protection and
data security-specific threats, taking into account existing organizational and technical protective measures as well as identified vulnerabilities and deficiencies. Information security and legal consequences can be distinguished. The identified risks can be managed and tracked as part of the risk management system. A report on the data protection risk analysis can be generated.
Recording of Data Protection Incidents
In the Incident Management module, data protection incidents can be managed separated.
