GDPR with ARRTECH
Records for accountability under Article 5(2).
Records that show how personal data was protected
Accountability means the organization can show what happened, on what evidence and who decided.
Requirements
| Clause | What it asks | Security support |
|---|---|---|
| Art. 5(1)(f) | Integrity and confidentiality. | DLP checks data before it leaves. → |
| Art. 5(2) | Accountability. | Signed, chained logs. → |
| Art. 30 | Records of processing. | DLP finds where personal data sits. → |
| Art. 32(1)(b) | Ongoing confidentiality and integrity. | Events from connected sources. → |
| Art. 33(5) | Breaches documented. | Case records with history. → |
Inventory
Discovery by a DLP helps locate personal data in supported endpoints, file servers and SQL databases. Review the findings with the data owner and use them to inform the organization’s inventory and handling decisions.
Security
DLP content policies can apply handling rules to covered transfers of personal data. An approved exception should retain its purpose and authority, giving reviewers a clear account of why sharing was permitted.
Breaches
Keep the facts, effects, assessment and response together as the investigation develops. A dated history helps the controller explain its notification and remediation decisions.
Accountability
Record integrity helps make activity evidence open to review. Accountability also needs the purpose, permissions and decisions around that activity, so the organization can explain what it did.
Residency
Customer-controlled hosting gives the organization a choice over where records are retained. The deployment also identifies support access, connected services and any information sent elsewhere.
Limits
The following responsibilities belong to the organization’s wider security and governance program. Their owners maintain the evidence needed for review.
Art. 33(1)
Notice to the supervisory authority, which the controller files.
Art. 35
Data protection impact assessment.
Art. 15 to 17
Data subject requests.
Art. 28
Processor terms with each vendor that processes personal data for the controller.
By rule
Use these references to connect the requirement with relevant operating evidence. The organization defines the scope and implementation being assessed.
Art. 5(1)(f)
Process personal data with appropriate security. DLP policies inspect covered transfers and apply the organization’s blocking or approval rules.
Art. 5(2)
Be able to demonstrate compliance. Signed records from a SIEM and verification material support an independent check of the evidence’s integrity.
Art. 30
Maintain a record of processing activities. Data discovery by a DLP helps locate personal information; the controller maintains the wider record of processing activities.
Art. 32(1)(b)
Ensure ongoing confidentiality, integrity and availability of systems. Collection-health monitoring in a SIEM shows when a source stops reporting and helps the team investigate the gap.
Art. 33(5)
Document any personal data breach, its effects and the remedy. A SOAR incident workflow retains ownership, evidence, approvals and actions so reviewers can follow the response.
Questions
Does GDPR certify products?
No. Article 42 certifies processing operations, and certification does not reduce the controller’s responsibility.
Is DLP monitoring of staff itself processing?
Yes. It needs its own lawful basis.
Does DLP find EU national identifiers?
Recognition depends on the identifier formats and classifiers supported in the deployment. Evaluate representative records before relying on coverage for a particular national identifier.
Can our assessor check the logs without ARRTECH?
Yes. A signed SIEM export includes the verification material and a standalone verifier, allowing an independent check of record integrity.
Guide
What is GDPR?
The EU regulation on the protection of personal data, binding on controllers and processors.
What does Article 30 ask?
A written record of processing activities, kept by controllers and processors.
What does Article 33 ask?
Article 33 addresses notification to the supervisory authority and documentation of personal data breaches. Where notification is required, it is due without undue delay and, where feasible, within 72 hours of awareness.
How ARRTECH takes care of GDPR accountability
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
