Frameworks / GDPR / GDPR-Art.35 GDPR
Chapter IV - Controller and Processor
GDPR GDPR-Art.35: Data protection impact assessment Where a type of processing, in particular using new technologies and taking account of the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data before the processing begins; a single assessment may address a set of similar operations presenting similar risks. An assessment is required in particular for systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions producing legal or similarly significant effects are based, for large scale processing of special category or criminal offence data, and for systematic monitoring of a publicly accessible area on a large scale. Seek the advice of the data protection officer where one is designated, and where appropriate seek the views of data subjects or their representatives. The assessment must contain at least a systematic description of the envisaged operations and purposes including any legitimate interest pursued, an assessment of the necessity and proportionality of the operations in relation to the purposes, an assessment of the risks to the rights and freedoms of data subjects, and the measures envisaged to address those risks including safeguards, security measures and mechanisms to protect personal data and demonstrate compliance. Carry out a review where necessary and at least when the risk represented by the processing operations changes.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 19 August 2026 What else in your programme already covers this This control maps to 417 controls across 185 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
ACC-7 ACC-7 Record the device in the record of processing and carry out a DPIA where risk is high, notably for biometrics ACT-1 ACT-1 Define the objective and scope of each control device and identify the risks to employees' rights before installing it ACT-6 ACT-6 Submit the device to the staff representative bodies before implementation TLW-3 TLW-3 Enter teleworker monitoring in the record of processing and run a DPIA for any constant monitoring VID-9 VID-9 Complete the formalities: register entry, DPO involvement, DPIA where required, prefectoral authorisation for areas open to the public CH-FADP-19 Transparency and proactive information CH-FADP-21 Data protection impact assessments FADP-16 FDPIC Independence and Functions FADP-7 Data Protection Impact Assessment (Articles 9-10) FADP-9 Data Protection Advisor (Articles 14-15) 5.4.1 Actions to address risks and opportunities 5.6.2 Information security risk assessment 7.2.5 Privacy impact assessment 8.2.1 Customer agreement ISO27799-03 Minimum necessary standard enforcement ISO27799-04 Patient data de-identification procedures ISO27799-05 Audit trail for ePHI access ISO27799-06 Security management process and risk analysis ISO23894-6.3 AI Risk Assessment ISO23894-6.3.1 AI Risk Identification ISO23894-6.3.3 AI Risk Evaluation ISO23894-A.5 Privacy and Data Protection in AI NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment NISTPF-4 Communicate-P - Privacy Notice, Transparency, and Individual Awareness NISTPF-7 Protect-P Maintenance and Protective Technology (PR.MA-P, PR.PT-P) NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) NDPA-1 Applicability, Scope, and Carve-Outs NDPA-4 Sensitive Data Processing Consent and Childrens Protections NDPA-7 Data Protection Assessments and Processor Contracts NDPA-8 Nebraska Attorney General Enforcement, Permanent 30-Day Cure, and Penalties NG-NDPA-1 Scope, Applicability, and Establishment of Nigeria Data Protection Commission NG-NDPA-4 Data Subject Rights and Automated Decision-Making NG-NDPA-7 Cross-Border Data Transfers and International Cooperation NG-NDPA-8 Enforcement, Penalties, Data Controllers of Major Importance (DCMI), and Compliance 3.2.2 3.2.2 Data protection impact assessment for high-risk monitoring and prior consultation if residual risk stays high 5.3(e) 5.3(e) Involve a representative sample of employees, and the works council where the law requires it 5.4.3 5.4.3 Mobile device management: DPIA first, a specified purpose, tracking held back until a device is lost AT-DSG-10 Section 29 - Liability and right to compensation / civil jurisdiction AT-DSG-12 Section 62 - Administrative penalties AT-DSG-7 Section 18 - Establishment of the Data Protection Authority BSI-13 Risk assessment procedures BSI-15 Security categorization BSI-17 Continuous monitoring strategy BB-DPA-1 Section 1 - Short Title BB-DPA-20 Sections 50-60 - Registration and Responsibilities BB-DPA-4 Section 4 - Principles Relating to Processing EUAI-Art.26 Obligations of deployers of high-risk AI systems EUAI-Art.27 Fundamental rights impact assessment for high-risk AI systems EUAI-Art.9 Risk management system IR-2 Incident Response Training RA-1 Policy and Procedures RA-3 Risk Assessment IR-2 Incident Response Training RA-1 Policy and Procedures RA-3 Risk Assessment 27011-5.2 Information Security Roles in Telecoms 27011-6.3 Awareness and Training 27011-8.6 Data protection and backup 29134-1 Scope 29134-3 Terms and definitions 29134-9.1 PIA report structure MTCS-Acquisition-Development-Maintenance-Supplier-Vulnerability-DevSecOps-SBOM-SDLC-SCA-API-Container MTCS Acquisition + Development + Maintenance + Supplier + Vulnerability + DevSecOps + SBOM + SDLC + SCA MTCS-Governance-ISMS-Risk-HR-Lifecycle-Compliance-Cloud-Strategy-Roles-Responsibilities MTCS Governance + ISMS + Risk Management + HR Security + Cloud Service Lifecycle + Compliance + Roles MTCS-Operations-Physical-Network-Tier-III-Data-Centre-Hardening-Patching-Network-Segmentation-DDoS MTCS Operations + Physical + Network + Tier III Data Centre + Hardening + Patching + Segmentation + DDoS NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions NIST-CSF-ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use NISTSP144-1 Cloud Governance, Risk Assessment, and Provider Trust Evaluation NISTSP144-3 Data Classification, Handling, and Sovereignty NISTSP144-5 Identity and Access in Cloud, Federation, and Privileged Access NISTSP145-3 Rapid Elasticity Characteristic and Capacity Management NISTSP145-7 Cloud Procurement Standards Aligned to NIST SP 800-145 Definition NISTSP145-8 Governance, Reporting, and Stakeholder Education on Cloud Definition NISTSP146-1 Cloud Adoption Strategy, Workload Suitability, and Decision Framework NISTSP146-6 Cloud Security and Privacy Recommendations NISTSP146-7 Service Level, Performance, Reliability, Interoperability, and Portability NISTSP30-3 Threat Source and Threat Event Identification NISTSP30-4 Vulnerability and Predisposing Condition Identification NISTSP30-6 Risk Determination, Uncertainty, and Sensitivity Analysis 25(1)(k) Art. 25(1)(k) Ask the works council's advice on a proposed decision: important technological facility 27(1)(k) Art. 27(1)(k) Obtain the works council's consent to a staff arrangement: processing and protection of staff personal data 27(1)(l) Art. 27(1)(l) Obtain the works council's consent to a staff arrangement: personnel tracking systems (monitoring of presence, behaviour or performance) RMI-DD-2 Supply Chain Information Collection RMI-SEG-2 Environmental Standards RMI-SEG-3 OHS and Governance SSAE18-CC3.1 CC3.1 - COSO Principle 6: Risk Identification SSAE18-CC3.2 CC3.2 - COSO Principle 7: Risk Analysis SSAE18-SOC1-02 Risk Assessment IM8-DAT.2 Data Protection IM8-DAT.4 Data Retention and Disposal IM8-SEC.4 Vulnerability Management TRINIDAD-1 Scope, Definitions, Commission TRINIDAD-4 Security, Accuracy TRINIDAD-5 Enforcement and Sanctions UNESCO-AI-PA1 Ethical Impact Assessment UNESCOAI-1 Principles 1-3: Proportionality, Safety, Fairness UNESCOAI-2 Principles 4-7: Sustainability, Privacy, Human Oversight, Transparency UGA-3 Accountability Principle UGA-6 Personal Data Protection Office UGA-7 Data Protection Officer API1164-07 Remote Access API1164-24 Vulnerability assessment for critical systems AWWA-1.2 Risk Assessment AWWA-3.4 Encryption and Data Protection AZ-DPA-15 Article 17 - Dispute resolution AZ-DPA-6 Article 6 - State regulation in personal data protection PIPL-Art55 Personal Information Protection Impact Assessment PIPL-Art56 PIPIA Content and Retention IS.D.OR.205 Information Security Risk Assessment IS.I.OR.205 Information Security Risk Assessment UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10) UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques) Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A) GhCSA-CII-Designation-Plan-Audit-Risk CII Designation, Registration, Cybersecurity Plan, Audit and Risk Assessment GhCSA-Implementation-Roadmap Implementation Roadmap - Organizational Roles, Tooling and Metrics IATF16949-Clause6-Planning-Risk-Contingency-Objectives-Change IATF 16949 Clause 6 - Planning + Risks and Opportunities + Contingency Plans + Quality Objectives + Change IATF16949-Clause8-Operation-APQP-Design-Production-ControlPlan-SpecialChars IATF 16949 Clause 8 - Operation Planning + APQP + Design + Special Characteristics + Production + Control Plan + Set-Up Verification ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18) ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain IEC62443-07 Personnel risk assessment IEC62443-24 Vulnerability assessment for critical systems IEEE1686-IR-Recovery-Reporting-Exercises-Drills-RECOV IEEE 1686 - Incident Response + Recovery from Failed Update + Reporting to Authorities + Coordination with Sector-Specific Agencies + Exercises and Drills IEEE1686-Section5.1-AccessControl-Accounts-Roles-Password-Session-Remote IEEE 1686 Section 5.1 - Electronic Access Account Management + Roles + Password + Failed Login + Session + Remote Access + Personnel IEEE7000-EthicalRisk-Identification-Analysis-Treatment-ValidationOutcomes IEEE 7000 Clauses 8 + 8.1 + 8.2 - Ethical Risk Identification + Analysis + Treatment + Validation of Ethical Outcomes + AI Safety + Robustness + Adversarial Protection IEEE7000-Operations-Lifecycle-OngoingMonitoring-Incident-Decommissioning IEEE 7000 - Operations + Lifecycle + Ongoing AI Risk Monitoring + Data Provenance + Retention + Privacy + Safe Deployment + Decommissioning + Disposal IRM-Process-Identification-Analysis-Evaluation-Treatment-Monitoring-Review-ISO31000-Aligned IRM Risk Management Process - 5-Stage Cycle + Identification + Analysis (Inherent/Residual) + Evaluation + Treatment (4Ts Tolerate/Treat/Transfer/Terminate) + Monitoring + Review + Communication + Risk Register IRM-RiskCategories-Strategic-Financial-Operational-Knowledge-FOIL-External-Internal-DownsideUpside IRM Four Risk Categories - Strategic + Financial + Operational + Knowledge + FOIL Typology + External vs Internal + Downside Threats and Upside Opportunities + Risk Universe ISO27003-6.1 Actions to address risks and opportunities ISO27003-8.2 Information security risk assessment ISO27019-07 Personnel risk assessment ISO27019-24 Vulnerability assessment for critical systems 27400-7.1 Network Security for IoT 27400-7.4 Data retention and deletion 27557-4.3 Individual impact consideration 27557-6.3 Privacy risk assessment INCDPA-Controller-PrivacyNotice-PurposeLimitation-DataMinimisation-Transparency-LawfulBasis Indiana CDPA Controller Obligations - Privacy Notice + Purpose Limitation + Data Minimisation + Transparency + Lawful Basis + Reasonable + Adequate + Relevant + Limited to What is Necessary INCDPA-SensitiveData-Children-Consent-COPPA-DataProtectionAssessment-DPIA Indiana CDPA Sensitive Data + Consent for Sensitive Categories + Children Under 13 + COPPA Coordination + Data Protection Assessment (DPA) + High-Risk Processing JP-AIG-Data-Governance-Training-Data-Quality-Provenance-Lineage-Copyright-APPI-Personal-Information-Protection Japan AI Guidelines Data Governance + Training Data Quality + Provenance + Lineage + Copyright Act 2018 Article 30-4 Text Data Mining Exception + APPI 2022 Amendment + Personal Information Protection + Privacy Principle JP-AIG-Scope-METI-MIC-AI-Guidelines-Business-v1.0-April2024-Society-5.0-Cabinet-Office-AI-Strategy-Council Japan AI Guidelines Scope + METI/MIC AI Guidelines for Business v1.0 (April 2024) + Society 5.0 + Cabinet Office AI Strategy Council + 10 Principles 2019 Heritage + Education + Literacy + Fair Competition + Innovation Principles JO-PDPL-Personal-Data-Protection-Council-Article4-5-6-Establishment-MoDEE-Functions-Powers-Investigation Jordan PDPL Personal Data Protection Council + Articles 4-5-6 + Establishment + Ministry of Digital Economy and Entrepreneurship (MoDEE) + Functions + Powers + Investigation + Administrative Penalties + Council Composition + International Cooperation JO-PDPL-Training-Awareness-Penalties-Article22-23-24-Compensation-Administrative-Criminal-100K-200K-JOD Jordan PDPL Training + Awareness + Penalties + Articles 22-23-24 + Compensation + Administrative Penalties JOD 100K + JOD 200K Repeat + Criminal 3 Years + Civil Compensation + Director Liability + Reasonable Care Defence LLOYDS-CI-Risk-Selection-Cyber-Hygiene-Underwriting-Criteria-Pre-Bind-Risk-Engineering-MFA-Backup-EDR Lloyds Cyber Insurance Risk Selection + Hygiene + Pre-Bind Engineering LLOYDS-CI-Systemic-Cyber-Risk-Aggregation-Cyber-Catastrophe-Modelling-Vendor-Use-RDS-Scenario-Testing Lloyds Cyber Insurance Systemic Aggregation + Catastrophe Modelling + RDS MDS2-Audit-Logging-AUDT-Integrity-IGAU-Cybersecurity-Risk-CYBR-Monitoring MDS2 Audit Controls + AUDT + Integrity + IGAU + Cybersecurity Risk + CYBR + Continuous Monitoring MDS2-PHI-Data-Handling-DATA-Storage-STCF-Transmission-TXCF-TXIG-Encryption-FIPS MDS2 PHI Handling + DATA + STCF Storage + TXCF Transmission + TXIG Integrity + Encryption + FIPS MU-DPA-Cross-Border-Transfer-Section-36-Adequacy-SCC-BCR-Mauritius-Global-Business-IBC-Financial-Services Mauritius DPA Cross-Border + Section 36 + Adequacy + SCC + BCR + Mauritius Global Business + Financial Services MU-DPA-Security-Breach-Notification-Section-25-BREACH-72-Hour-Commissioner-Cyber-Security-Strategy Mauritius DPA Security + Breach Notification + Section 25-BREACH + 72 Hour + Commissioner + Cyber Security Strategy MX-LFPDPPP-Cross-Border-Transfer-Articles-36-37-Reglamento-66-68-Domestic-International-APEC-CBPR-USMCA Mexico LFPDPPP Cross-Border + Articles 36-37 + Reglamento 66 + 68 + Domestic + International + APEC CBPR + USMCA MX-LFPDPPP-Security-Breach-Notification-Reglamento-63-No-Time-Limit-INAI-Recommendations-CERT-MX Mexico LFPDPPP Security + Breach Notification + Reglamento 63 + No Specified Time + INAI Recommendations + CERT-MX NAIC-1 NAIC Model Law Adoption, Scope, and Licensee Definitions NAIC-2 Information Security Program (ISP) - Section 4 NISTSP37-2 RMF Categorize Step: Information and System Categorisation NISTSP37-3 RMF Select Step: Security and Privacy Control Selection NISTSP66-1 Security Management Process: Risk Analysis and Risk Management for ePHI NISTSP66-6 Technical Safeguards: Access Control, Audit Controls, Integrity, Person Authentication NRFCS-1 Retail Cybersecurity Governance, Policy, and Regulatory Change Management NRFCS-2 Risk Assessment, Customer Data Inventory, Classification, and Retail Threat Model NHPA-7 Data Protection Assessments and Processor Contracts NHPA-8 AG Formella Enforcement, Permanent 60-Day Cure, and Penalties NJDPA-7 Data Protection Assessments and Processor Contracts NJDPA-8 AG Platkin Enforcement, 18-Month Cure Sunset, and Division of Consumer Affairs NZISM-1 NZISM Governance, Documentation, and Classification System NZISM-3 Personnel Security, Physical Security, and Cryptography NGNDPR-5 Security of Personal Data, Breach Notification, and DPIA under NDPR Section 2.6-Security NGNDPR-6 Data Protection Officer, DPCOs, and Processor Obligations OECDAI-3 Robustness, Security, Safety, and Adversarial Attack Protection OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation OREGONCPA-5 Data Protection Assessments, Privacy by Design, Security Practices OREGONCPA-8 Cure Period, Attorney General Enforcement, Training, Compliance Monitoring ORSA-S1 Guidance Manual Section 1: Description of the insurer's risk management framework ORSA-S2 Guidance Manual Section 2: Insurer's assessment of risk exposures PDPASG-1 Accountability, Records, DPO Appointment, and Training PDPASG-4 Children's Data, DPIA, and Privacy by Design PDPATH-4 DPIA, Privacy by Design, Children's Data PDPATH-7 DPO, Records of Processing, Retention, Marketing, Training POPIASA-4 Special Personal Information, Children, Information Quality, Documentation POPIASA-7 Information Officer, Records of Processing, Notification, Training NORWAY-4 DPIA, Privacy by Design, Records of Processing NORWAY-7 DPO, Cooperation with Datatilsynet, Retention, Marketing, Training NZPRV-6 IPP 13 Unique Identifiers, Privacy Impact Assessment, Privacy by Design NZPRV-8 Privacy Officer, OPC Cooperation, Compliance Notices, Complaints, Training SOC-CY-C2 Encryption and Data Protection SOC-CY-DC5 Risk Assessment Process 2.4.4 Hazard Analysis and Risk Assessment 2.7.2 Food Fraud Plan SA-PDPL-19 Data protection officer designation SA-PDPL-21 Data protection impact assessments ISMSP-MS-02 Risk Management ISMSP-SYS-04 Vulnerability Management SWE-1 Scope and Purpose SWE-2 Relationship to GDPR CRM-1 AML/CFT Compliance CRM-4 Business Risk Assessment UKAI-1 Risk-Based Approach and Pro-Innovation Principles UKAI-2 Sector-Specific Regulator Engagement Standard 15 Online Tools Standard 2 Data Protection Impact Assessments UKGDPRREG-2 Data Subject Rights (Articles 12-22) UKGDPRREG-3 Controller and Processor (Articles 24-43) CPSC-CS.3 Data Protection for Safety Systems CPSC-RA.3 Lifecycle Risk Assessment URUGUAY-4 Security and Cross-Border URUGUAY-5 Database Registration with AGESIC URCDP 14 s 14 Good faith consultation with workers on proposed surveillance AMLCTF-PartA-RiskAssess ML/TF Risk Assessment CPS230-11 Identification, Assessment and Management of Operational Risk SPS220-22 Framework Enabling Strategies, Policies, Procedures and Controls ASD37-27 Outbound data loss prevention (Very Good) 4.3.1 Risk Assessment and Impact Analysis AL-DPA-14 Direct Marketing AUCDR-IS-STEP3 Step 3 - Have and maintain an information security capability P1-S1 Advance Electronic Information BE-DPA-9 Specific data protection impact assessment C5-OIS-07 Application of the Risk Management Policy CPG-3.C Strong and Agile Encryption RDCOC-DPI-01 Data Protection Impact Assessments 10 10 DPIA for large-scale monitoring of public areas and large-scale special category processing; consult if high risk remains FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711) L2312-38 al3 L2312-38 al3 Inform and consult the CSE before deciding to implement any means or technique for controlling employees' activity GGAP-IFA-AllFarmBase-Mgmt-Workers-Env-Trace GLOBALG.A.P. IFA v6 All Farm Base (AF): Management, Workers, Environment, Traceability and Food Safety s67 s 67 Assess the impact before high-risk processing and involve the Federal Commissioner IMO-MSC-FAL-Identify-AssetInventory-ThreatsVulnerabilities-CyberRiskAssessment-RolesResponsibilities IMO MSC-FAL Identify Function - OT/IT Asset Inventory + Threats + Vulnerabilities + Cyber Risk Assessment + Roles and Responsibilities + Crew + CSO + DPA ISO-22313-8.2 Business impact analysis and risk assessment ISO-26000-6.7 Consumer issues ISO-26262-3-7 Hazard analysis and risk assessment (HARA) 5.8 Information security in project management 5.8 Information security in project management 27031-7.2 Resource Requirements 29147-5.11 Researcher Safe Harbour and Legal Posture LGPD-BR-Governance-Encarregado-DPO-ROPA-DPIA-Privacy-by-Design-Article-46-50-Codes-of-Conduct Brazil LGPD Governance + Encarregado (DPO) + ROPA + DPIA + Articles 46-50 MY-PDPA-DPO-Designation-Class-Data-User-Registration-DPIA-Code-Practice-Section-43A-2024-Amendment Malaysia PDPA Governance + DPO Section 43A + Class of Data User Registration + DPIA + Code of Practice MN-CDPA-Data-Privacy-Assessment-DPIA-Section-325O-07-Sensitive-Targeted-Sale-Profiling-AI-Consumer-Health Minnesota CDPA DPIA + Section 325O.07 + Sensitive + Targeted + Sale + Profiling + AI + Consumer Health MT-CDPA-Data-Protection-Assessment-MCA-30-14-2815-Sensitive-Targeted-Sale-Profiling-AG-Inspection Montana CDPA Data Protection Assessment + MCA 30-14-2815 + Sensitive + Targeted + Sale + Profiling + AG Inspection NERCCIP-5 System Security Management + Configuration Change Management and Vulnerability Assessments (CIP-007 + CIP-010) NFPA1600-5.1 Risk Assessment Art.21.2.a Policies on risk analysis and on information system security NISTSP122-8 Continuous Monitoring, Training, and Privacy Programme Governance NISTSP39-3 Risk Assessing: Organisation, Mission, and System Level Assessments NISTSP82-2 OT Risk Assessment and Threat/Vulnerability Identification NGCB-7 Patron and Employee Data Protection + Data Inventory + Vendor Management NGOB-1 Open Banking Registry Participation, Tiered Categorisation, and KYP PIA Privacy Impact Assessment OECDMNE-5 Environment, Climate, and Biodiversity OMANCS-4 Data Protection, Cryptography, and Privacy Alignment PARAGUAY-5 Security of Processing, Data Integrity, Information Security PERU-3 Data Subject Rights (ARCO), Habeas Data, Automated Decisions QATAR-7 DPO, Records, Retention, Marketing, Training RO-LAW190-013 Data Protection Impact Assessments PICERL-P2 Risk Assessment SECCLIM-2 Risk Management: Identification, Assessment, Integration SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7) SOCI-S30CU Vulnerability assessments SCA-S10 Annual Risk Assessment CIA-RISK-16 Risk assessment for personal credit information PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 STUDPRV-2 Data Subject Rights for Students and Parents TEF-2 Openness and Transparency TISAXASS-3 Prototype Protection and Confidentiality TSAPIPE-1 Cybersecurity Implementation Plan and Coordinator TAIWAN-3 Data Subject Rights TANZANIA-1 Scope, Registration, Lawful Basis TSSR-INFO-1 Network Data Protection TEXASTDPSA-3 Sensitive Data, Children, Sale Notice TURKEYKVKK-3 Special Categories and Sensitive Data D.1 Incident Response Planning UKOPRES-3 Self-Assessment and Board Engagement s.54(5) Statement Content Requirements SEMD-SP-2 Risk Identification and Assessment UNICEFAI-4 Transparency, Explanation, Adult Capacity US-ITAR-EAR-DS-01 Technical Data Protection VIETNAMPDP-3 Data Subject Rights VIRGINIAVCDPA-3 Sensitive Data Consent and Children ZDPA-10 Data Protection Impact Assessment Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Chapter IV - Controller and Processor You are reading one control. How much of GDPR have you already done? GDPR GDPR-Art.35 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of GDPR your existing evidence covers. Hold ISO 27701:2019 and 21 of 41 GDPR controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the ISO 27701:2019 pair alone.
Query this from an agent The graph holds this control, the 417 it maps to, and the evidence behind each claim, over MCP and REST.