| name | implementing-gdpr-data-protection-controls |
| description | The General Data Protection Regulation (EU) 2016/679 (GDPR) is the EU's comprehensive data protection law governing the collection, processing, storage, and transfer of personal data. This skill cover |
| domain | cybersecurity |
| subdomain | compliance-governance |
| tags | ["compliance","governance","gdpr","privacy","data-protection","eu-regulation"] |
| nist_csf | ["GV.OC-02","GV.PO-01","PR.DS-01","PR.AA-01","ID.AM-02"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_ai_rmf | ["MEASURE-2.7","MAP-5.1","MANAGE-2.4","MEASURE-2.8","MEASURE-2.9"] |
| atlas_techniques | ["AML.T0070","AML.T0066","AML.T0082"] |
Implementing GDPR Data Protection Controls
Overview
The General Data Protection Regulation (EU) 2016/679 (GDPR) is the EU's comprehensive data protection law governing the collection, processing, storage, and transfer of personal data. This skill covers implementing the technical and organizational measures required by GDPR, including data protection by design and by default, Data Protection Impact Assessments (DPIAs), data subject rights management, breach notification procedures, and cross-border data transfer mechanisms.
When to Use
- When deploying or configuring implementing gdpr data protection controls capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Common Misconfigurations & Verification
GDPR programs fail most often where the legal documentation exists but the
technical control behind it was never wired up:
- ROPA (Art. 30) drifts from reality: the register lists 40 processing
activities but data-flow mapping misses shadow SaaS, analytics SDKs, and
legacy replicas. Verify by reconciling ROPA entries against actual egress
logs and DPA inventories, not against last year's spreadsheet.
- DPIA (Art. 35) written but not enforced: the assessment recommends
pseudonymization or retention limits that were never implemented. Confirm by
querying the live datastore for the field the DPIA said would be tokenized.
- Erasure (Art. 17) skips backups and downstream copies: issue a real test
erasure request and confirm the subject is gone from primaries, replicas,
search indexes, and restored-backup samples.
- Access (Art. 15) SLA untested: submit a live DSAR and time it against the
one-month deadline.
- Transfers (Art. 44-49): SCCs are signed but traffic still lands in a
non-adequate region with no TIA. Trace the actual TLS endpoint/IP, not the
contract.
Prerequisites
- Understanding of EU data protection law and its territorial scope
- Knowledge of personal data processing activities within the organization
- Familiarity with data architecture, databases, and application systems
- Understanding of data flows including cross-border transfers
Core Concepts
Key GDPR Articles for Technical Controls
