Obligations by role under GDPR, NIS2 and DORA

GDPR

Controller

16 obligations

0 of 16 ticked

Principles and lawfulness

Process personal data lawfully, fairly and transparently, and keep it accurate, minimised and storage limited.
gdpr-art-5
Establish and document a lawful basis for every processing purpose before processing starts.
gdpr-art-6
Where processing rests on consent, be able to demonstrate it and honour withdrawal as easily as it was given.
gdpr-art-7
Apply the Article 9 conditions before processing special categories of personal data.
gdpr-art-9
Implement data protection by design and by default in every new processing operation.
gdpr-art-25

Data subject rights

Answer data subject requests within one month, with transparent information about the handling.
gdpr-art-12
Provide the Article 13 information at the point where personal data is collected.
gdpr-art-13
Provide the Article 14 information within a reasonable period when data was not obtained from the data subject.
gdpr-art-14
Operate intake and fulfilment for access and erasure requests, including notification of recipients.
gdpr-art-15 gdpr-art-17 gdpr-art-19
Stop processing when a data subject objects, unless you demonstrate compelling legitimate grounds; treat direct marketing objections as absolute.
gdpr-art-21

Records and accountability

Take responsibility for compliance with the principles and be able to demonstrate it.
gdpr-art-24
Maintain a record of processing activities under your responsibility.
gdpr-art-30
Carry out a data protection impact assessment before processing likely to result in a high risk.
gdpr-art-35
Designate a data protection officer where Article 37(1) requires it.
gdpr-art-37

Breach and notification

Notify personal data breaches to the supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to risk rights and freedoms.
gdpr-art-33
Communicate high risk breaches to affected data subjects without undue delay.
gdpr-art-34

Each line is a GAGE paraphrase of the provisions beside it, written to be read quickly. The official text is always the authority: follow any citation to read it. Ticks are kept in this browser and are a working aid, not a record of compliance.

What your role has to do

Controller

Principles and lawfulness

Data subject rights

Records and accountability

Breach and notification