| name | implementing-gdpr-data-protection-controls |
| description | Implements GDPR (EU 2016/679) technical and organizational measures — privacy by design/default, DPIAs, data subject rights management, 72-hour breach notification, and cross-border transfer mechanisms (SCCs, BCRs, adequacy). Use when designing or auditing GDPR controls, building a DPIA, handling data subject access/erasure requests, or assessing cross-border data transfers. |
| domain | cybersecurity |
| subdomain | compliance-governance |
| tags | ["compliance","governance","gdpr","privacy","data-protection","eu-regulation"] |
| nist_csf | ["GV.OC-02","GV.PO-01","PR.DS-01","PR.AA-01","ID.AM-02"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_ai_rmf | ["MEASURE-2.7","MAP-5.1","MANAGE-2.4","MEASURE-2.8","MEASURE-2.9"] |
| atlas_techniques | ["AML.T0070","AML.T0066","AML.T0082"] |
| mitre_attack | ["T1078","T1530","T1685.002"] |
Implementing GDPR Data Protection Controls
Overview
The General Data Protection Regulation (EU) 2016/679 (GDPR) is the EU's comprehensive data protection law governing the collection, processing, storage, and transfer of personal data. This skill covers implementing the technical and organizational measures required by GDPR, including data protection by design and by default, Data Protection Impact Assessments (DPIAs), data subject rights management, breach notification procedures, and cross-border data transfer mechanisms.
When to Use
- When deploying or configuring implementing gdpr data protection controls capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Understanding of EU data protection law and its territorial scope
- Knowledge of personal data processing activities within the organization
- Familiarity with data architecture, databases, and application systems
- Understanding of data flows including cross-border transfers
Core Concepts
Key GDPR Articles for Technical Controls
| Article | Requirement |
|---|
| Art. 5 | Principles: lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability |
| Art. 6 | Lawful basis for processing (consent, contract, legal obligation, vital interests, public task, legitimate interest) |
| Art. 25 | Data protection by design and by default |
| Art. 28 | Processor obligations and contractual requirements |
| Art. 30 | Records of processing activities (ROPA) |
| Art. 32 | Security of processing (technical and organizational measures) |
| Art. 33 | Breach notification to supervisory authority (72 hours) |
| Art. 34 | Communication of breach to data subjects |
| Art. 35 | Data Protection Impact Assessment (DPIA) |
| Art. 37-39 | Data Protection Officer (DPO) appointment and role |
| Art. 44-49 | Cross-border data transfers (adequacy, SCCs, BCRs) |
Article 32 Security Measures
The regulation requires organizations to implement measures appropriate to the risk:
