GDPR GDPR-Art.29: Processing under the authority of the controller or processor

What else in your programme already covers this

This control maps to 35 controls across 19 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

C5 (Germany) · 4 controls

C5-AM-02 Acceptable Use and Safe Handling of Assets Policy
C5-AM-05 Commitment to Permissible Use, Safe Handling and Return of Assets
C5-HR-02 Employment terms and conditions
C5-HR-06 Confidentiality agreements

ISO 27001:2022 · 4 controls

5.10 Acceptable use of information and other associated assets
5.37 Documented operating procedures
6.2 Terms and conditions of employment
6.6 Confidentiality or non-disclosure agreements

ISO 27002:2022 · 4 controls

5.10 Acceptable use of information and other associated assets
5.37 Documented operating procedures
6.2 Terms and conditions of employment
6.6 Confidentiality or non-disclosure agreements

FedRAMP High · 3 controls

AC-3 Access Enforcement
PL-4 Rules of Behavior
PS-6 Access Agreements

FedRAMP Moderate · 3 controls

AC-3 Access Enforcement
PL-4 Rules of Behavior
PS-6 Access Agreements

Australia My Health Records Act 2012 · 2 controls

MYHR-ENF-3 Criminal offences and sanctions
MYHR-SEC-4 Training of authorised employees

ISO 27701:2019 · 2 controls

8.2.2 Organization’s purposes
8.2.3 Marketing and advertising use

NIST SP 800-53 Rev 5 · 2 controls

NIST800-AC-6 AC-6 Least Privilege
NIST800-PS-6 PS-6 Access Agreements

APEC Cross-Border Privacy Rules (CBPR) System · 1 control

CBPR-PR-47 Processor agreement content

APPI · 1 control

APPI-A24 Supervision of Employees

CCPA/CPRA · 1 control

CCR §7050 Service Provider and Contractor Obligations

CNIL Guidance on Employee Monitoring and Workplace Video Surveillance · 1 control

VID-6 VID-6 Limit viewing of images to authorised, trained persons and secure access

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

CCM-IAM-05 Least Privilege

DORA · 1 control

DORA-Art.9 Protection and prevention

Germany Federal Data Protection Act (BDSG) · 1 control

s52 s 52 Staff and processors act only on the controller's instructions

ILO Code of Practice on the Protection of Workers' Personal Data (1997) · 1 control

5.12 5.12 Confidentiality for everyone with access

Italy Personal Data Protection Code (Legislative Decree No. 196/2003, amended 2018) · 1 control

Art. 2-quaterdecies Art. 2-quaterdecies Designate and authorise the people who process data under your authority

NIS2 Directive · 1 control

Art.21.2.i Human resources security, access control policies and asset management

SOC 2 · 1 control

SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of GDPR have you already done?

GDPR GDPR-Art.29 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of GDPR your existing evidence covers. Hold ISO 27701:2019 and 21 of 41 GDPR controls already carry evidence.

If you hold ISO 27701:201951.2% covered · 20 gaps If you hold Australia Consumer Data Right - Banking (CDR)34.1% covered · 27 gaps If you hold Australia My Health Records Act 201234.1% covered · 27 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.134.1% covered · 27 gaps If you hold NIST SP 800-53 Rev 534.1% covered · 27 gaps If you hold APEC Cross-Border Privacy Rules (CBPR) System31.7% covered · 28 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the ISO 27701:2019 pair alone.

See the released pairs, $299 each Browse the graph free