GDPR

What is the GDPR?

The GDPR (General Data Protection Regulation), Regulation (EU) 2016/679, is the European regulation governing how personal data is processed. Applicable since 25 May 2018, it binds any organization processing the personal data of people in the European Union, wherever that organization is itself established. It sets principles, individual rights, and obligations for both controllers and processors.

The obligations that touch identity and access directly

• Article 5(1)(f): personal data must be processed with appropriate security, including protection against unauthorized access.
• Article 30: controllers and processors must maintain a record of processing activities, which presupposes knowing which systems process personal data.
• Article 28: a processor may only be engaged under a contract, which is the data processing agreement every SaaS vendor should provide.
• Article 32: appropriate technical and organizational measures, judged against risk, cost, and the state of the art.
• Article 33: notification of a personal data breach to the supervisory authority within 72 hours.

You cannot document what you have not discovered

The Article 30 record requires listing the tools that process personal data. Every application bought outside IT and never declared is a hole in that record, and the company does not know the hole is there. This is where shadow IT stops being an IT annoyance and becomes regulatory exposure: a supervisory authority asking for the processing record receives a document that is sincere and incomplete.

Examples and use cases

A company maintains a careful Article 30 record covering 40 applications. Discovery finds 118 in active use, including a transcription tool processing recorded customer calls and an AI assistant connected to the shared drive, neither of which appears anywhere in the record. Nothing was hidden deliberately. The record was built from what the data protection officer knew to ask about. Corma supplies the continuous discovery that keeps the processing record aligned with the estate rather than with memory.

Related concepts

• Full visibility to prevent shadow IT
• Automated identity governance and administration
• SaaS management platform

FAQ

Does the GDPR require access reviews?

Not by name. Article 32 requires appropriate security measures and Article 5(1)(f) requires protection against unauthorized access, and a documented access review is the usual way to demonstrate both.

What is a data processing agreement?

The contract required by Article 28 between a controller and a processor, defining the subject matter, duration, purpose, obligations, and sub-processor rules of the processing.

Does the GDPR apply to non-European companies?

Yes. Under Article 3 it applies wherever an organization offers goods or services to people in the EU or monitors their behavior. Establishment in Europe is not the test.

What is the maximum GDPR fine?

Up to 20 million euros or 4 percent of total worldwide annual turnover for the preceding financial year, whichever figure is higher.

Request a demo