GDPR
Chapter II - Principles

GDPR GDPR-Art.5: Principles relating to processing of personal data

Process personal data lawfully, fairly and in a transparent manner; collect it for specified, explicit and legitimate purposes and do not process it further in a way incompatible with those purposes; keep it adequate, relevant and limited to what the purpose needs; keep it accurate and up to date, erasing or rectifying inaccurate data without delay; keep it in a form permitting identification no longer than the purpose requires; and secure it against unauthorised or unlawful processing and against accidental loss, destruction or damage using appropriate technical or organisational measures. The controller is responsible for all six principles and must be able to demonstrate compliance with them.

What else in your programme already covers this

This control maps to 177 controls across 67 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

AICPA Privacy Management Framework (PMF) · 9 controls

ENISA Data Protection Engineering - From Theory to Practice · 9 controls

APEC Cross-Border Privacy Rules (CBPR) System · 7 controls

Canadian PIPEDA · 7 controls

APPI · 6 controls

  • APPI-A17 Specification of the Purpose of Use
  • APPI-A18 Restriction on Handling Beyond the Purpose of Use
  • APPI-A19 Prohibition of Improper Use
  • APPI-A20 Proper Acquisition and Special Care Required Personal Information
  • APPI-A22 Accuracy and Deletion of Personal Data
  • APPI-A23 Security Control Measures

Colombia Data Protection Law (Law 1581 of 2012) · 6 controls

Australia Consumer Data Right - Banking (CDR) · 5 controls

  • AUCDR-PS-11 Privacy Safeguard 11 - Quality of CDR data
  • AUCDR-PS-12 Privacy Safeguard 12 - Security of CDR data and destruction or de-identification of redundant CDR data
  • AUCDR-PS-4 Privacy Safeguard 4 - Dealing with unsolicited CDR data
  • AUCDR-PS-6 Privacy Safeguard 6 - Use or disclosure of CDR data
  • AUCDR-PS-9 Privacy Safeguard 9 - Adoption or disclosure of government related identifiers

Cayman Islands Data Protection Act 2017 (DPA) · 5 controls

  • CAYDPA-P1 First Principle - Fair and Lawful Processing
  • CAYDPA-P2 Second Principle - Purpose Limitation
  • CAYDPA-P3 Third Principle - Adequate, Relevant and Not Excessive
  • CAYDPA-P4 Fourth Principle - Accuracy
  • CAYDPA-P5 Fifth Principle - Storage Limitation

China Personal Information Protection Law (PIPL) · 5 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 5 controls

ISO 27701:2019 · 5 controls

  • 7.2.1 Identify and document purpose
  • 7.4.2 Limit processing
  • 7.4.3 Accuracy and quality
  • 7.4.5 PII de-identification and deletion at the end of processing
  • 7.4.7 Retention

NIST SP 800-53 Rev 5 · 5 controls

  • NIST800-PM-22 Personally Identifiable Information Quality Management. Develop and document organization-wide policies and procedures for: Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle; Correcting or deleting inaccurate
  • NIST800-PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research. Develop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training, and research; Limit or
  • NIST800-PT-2 Authority to Process Personally Identifiable Information. Determine and document the [organization-defined] that permits the [organization-defined] of personally identifiable information; and Restrict the [organization-defined] of personally identifiable information to only that which is authorized
  • NIST800-PT-3 Personally Identifiable Information Processing Purposes. Identify and document the [organization-defined] for processing personally identifiable information; Describe the purpose(s) in the public privacy notices and policies of the organization; Restrict the [organization-defined] of personally identifiable
  • NIST800-SI-12 Information management and retention

African Union Malabo Convention · 4 controls

Australia My Health Records Act 2012 · 4 controls

  • MYHR-CUD-1 Authorised collection, use and disclosure only
  • MYHR-CUD-2 Prohibition on unauthorised collection, use and disclosure
  • MYHR-CUD-3 Use limited to My Health Record purposes
  • MYHR-GOV-5 Retention, destruction and correction obligations of the System Operator

Australian Privacy Principles (APPs) · 4 controls

  • APP-10 APP 10 - Quality of personal information
  • APP-11 APP 11 - Security of personal information
  • APP-3 APP 3 - Collection of solicited personal information
  • APP-6 APP 6 - Use or disclosure of personal information

Cambodia Sub-Decree on Personal Data Protection (Sub-Decree No. 134) · 4 controls

Code of Conduct on Data Protection for Research (GDPR Article 40) · 4 controls

SOC 2 · 4 controls

  • SOC2-P3.1 Personal information is collected consistent with privacy commitments
  • SOC2-P4.1 Personal information is used for purposes identified in privacy commitments
  • SOC2-P4.2 Personal information is retained for only as long as needed
  • SOC2-P7.1 Personal information collected is limited to what is necessary and relevant

Argentina Law 25.326 (Personal Data Protection Law) · 3 controls

Botswana Data Protection Act (2024) · 3 controls

CCPA/CPRA · 3 controls

Colorado Privacy Act · 3 controls

Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) · 3 controls

  • EST-IKS-§14-21 Principles of processing by law enforcement authorities
  • EST-IKS-§2 Specifications for application of the Act and Regulation (EU) 2016/679
  • EST-IKS-§6 Processing for scientific and historical research and official statistics

Ethiopia Personal Data Protection Proclamation (No. 1321/2024) · 3 controls

ISO 27001:2022 · 3 controls

  • 5.33 Protection of records
  • 5.34 Privacy and protection of personal identifiable information (PII)
  • 8.10 Information deletion

ISO 27002:2022 · 3 controls

  • 5.33 Protection of records
  • 5.34 Privacy and protection of PII
  • 8.10 Information deletion

eIDAS 2.0 - EU Digital Identity Regulation · 3 controls

Act on the Implementation of the General Data Protection Regulation (OG 42/2018) · 2 controls

Armenia Law on Protection of Personal Data (2015) · 2 controls

Bermuda Personal Information Protection Act 2016 (PIPA) · 2 controls

Bosnia and Herzegovina Law on Protection of Personal Data (2006, amended 2011) · 2 controls

Chile Personal Data Protection Law (Law No. 21.719) · 2 controls

China Cybersecurity Law (CSL) · 2 controls

  • CSL-Art40 Confidentiality of User Information - Art. 40
  • CSL-Art42 Personal Information Protection and Breach Handling - Art. 42

Connecticut Data Privacy Act (CTDPA) · 2 controls

Consumer Data Right (CDR) Framework (Australia) · 2 controls

  • CDR-PS-1 Privacy Safeguard 1: Open and Transparent Management of CDR Data
  • CDR-PS-11 Privacy Safeguard 11: Quality of CDR Data

DORA · 2 controls

EMV 3‑D Secure (3DS) - Payment Authentication Protocol · 2 controls

  • EMV3DS-16 App-based channel and device information
  • EMV3DS-21 Cardholder data protection and minimisation

EU AI Act · 2 controls

  • EUAI-Art.10 Data and data governance
  • EUAI-Art.59 Further processing of personal data for developing certain AI systems in the public interest in the AI regulatory sandbox

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 2 controls

  • UAE-PDPL-Art.1_2_3 Scope, definitions and applicability (UAE PDPL Articles 1-3)
  • UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5)

Administrative Measures for the Security Assessment of Generative AI Services (2023) and Algorithmic Recommendation Management Provisions (2022) · 1 control

Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014) · 1 control

Angola Personal Data Protection Law (Law No. 22/11) · 1 control

C5 (Germany) · 1 control

  • C5-OPS-11 Logging and Monitoring - Metadata Management Concept

COPPA · 1 control

  • COPPA-312.10 Data Retention and Deletion (Written Retention Policy)

Costa Rica Personal Data Protection Law (Law No. 8968) as amended by Executive Decree No. 42089-MGP · 1 control

Danish Data Protection Act (Databeskyttelsesloven) · 1 control

Data Protection Act 2017 · 1 control

  • MU-DPA17-s21 Principles relating to processing of personal data

Digital Economy Partnership Agreement (DEPA) · 1 control

  • DEPA-4.2 Personal Information Protection

Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law · 1 control

Directive (EU) 2023/970 on pay transparency · 1 control

EDM Council CDMC - Cloud Data Management Capability Framework · 1 control

ESRB Privacy Certified · 1 control

  • ESRB-PC-10 Data minimisation for child personal information

ETSI EN 303 645 · 1 control

  • EN303645-6 Data Protection Provisions for Consumer IoT (Clause 6)

EU AI Liability Directive · 1 control

  • AILD-Art.3.4 Proportionality and trade-secret protection (Article 3(4))

EU Clinical Trials Regulation (CTR 536/2014) · 1 control

EU Payment Services Directive (PSD2) · 1 control

  • PSD2-Art.94 Data protection (PSD2 Article 94) - GDPR alignment

EU Product Liability Directive (Directive (EU) 2024/2853) · 1 control

  • PLD-Art.6 Categories of damage covered (PLD Article 6)

EU Seveso III Directive (Directive 2012/18/EU) · 1 control

  • SEV-Art.22_23 Access to information + access to justice + confidentiality (Seveso III Articles 22 and 23)

Egypt Personal Data Protection Law (Law No. 151 of 2020) · 1 control

FATF 40 Recommendations · 1 control

  • FATF-R.10_11 Customer Due Diligence + Record Keeping (FATF R.10 and R.11)

FedRAMP High · 1 control

  • SI-12 Information Management and Retention

FedRAMP Moderate · 1 control

  • SI-12 Information Management and Retention

NIS2 Directive · 1 control

  • Art.21.2.a Policies on risk analysis and on information system security

NIST Cybersecurity Framework 2.0 · 1 control

  • NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed

NIST SP 800-53 Rev 5 LOW · 1 control

  • SI-12 Information Management and Retention

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • SI-12 Information Management and Retention

NIST SP 800-53 Revision 5.1 HIGH · 1 control

  • SI-12 Information Management and Retention

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Chapter II - Principles

You are reading one control. How much of GDPR have you already done?

GDPR GDPR-Art.5 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of GDPR your existing evidence covers. Hold ISO 27701:2019 and 21 of 40 GDPR controls already carry evidence.

If you hold ISO 27701:201952.5% covered · 19 gapsIf you hold Australia Consumer Data Right - Banking (CDR)35% covered · 26 gapsIf you hold Australia My Health Records Act 201235% covered · 26 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.135% covered · 26 gapsIf you hold NIST SP 800-53 Rev 535% covered · 26 gapsIf you hold APEC Cross-Border Privacy Rules (CBPR) System32.5% covered · 27 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the ISO 27701:2019 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 177 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll GDPR controls