Art. 30

Records of processing

Activities, purposes, data subjects, data categories, recipients, transfers, retention and measures are connected in a maintainable structure.

Art. 35

DPIA

Screening, risk, necessity and proportionality, safeguards and review without turning automation into an automated legal conclusion.

Art. 33–34

Data breach

Breach timeline, awareness time, risk analysis, reasoned decision and workflow for required notifications and communications.

Art. 28 / 44–49

Vendors and transfers

Processors, subprocessors, agreements, due diligence, third countries, SCCs and TIAs are governed within the project.

EVIDENCE-DRIVEN

Upload once. Reuse with traceability.

Company records, contracts, policies, organization charts, software inventories and other attachments feed conservative autofill. Existing information is not automatically overwritten and professional conclusions remain subject to confirmation.

01 Collect evidence02 Map processing03 Assess risks and DPIA04 Generate and validate05 Keep current

A NEW PROJECT SCHEME

GDPR is activated like any other ISOPILOT scheme.

Available in Starter, Professional and Enterprise according to their scheme and project limits. The MOG 231 Governance plan remains dedicated exclusively to MOG231.

Compare plans

LEGAL BASELINE · 28 AUGUST 2026

GDPR + Italian framework + supervisory guidance

The workspace is structured around Regulation (EU) 2016/679, the Italian Privacy Code as amended by Legislative Decree 101/2018 and, where relevant, Garante decisions, EDPB guidance, cookie/ePrivacy rules and the current instruments for international transfers. Concrete applicability remains a case-by-case assessment.

Accountability, not “automatic compliance”.

ISOPILOT organizes data, evidence, workflows and document drafts. Applicability, legal bases, DPIAs, transfers, adequacy of safeguards and approvals remain case-specific decisions requiring validation.

From processing activities to evidence. Privacy governance that stays current.