Regulation (EU) 2016/679 - since 2018

GDPR starts with a record, not a policy

Article 30 asks what personal data you process, why, on what legal basis, and who receives it. In eramba that record is a data flow, built from assets you already classified, and it is the thing every other GDPR question hangs off.

Download the free edition See how a record is built

Data privacy module included
Flat annual fee
Self-hosted in the EU

One record of processingArticle 30

Classify the data assetInvoices, employee records, card data. Only assets tagged as a data asset reach the next step.Assets
Draw the data flowWhere it is collected, where it travels, where it rests.Data Flows
Name the purpose and the legal basisWhy you process it, and which lawful ground carries it.Data Flows
Attach the recipientsEvery processor acting on your behalf, with the agreement behind it.Third parties
Point it at a control or a policyThe safeguard that makes the processing defensible, tested on a schedule.Controls

Eight questions, and where each answer lives

Starting GDPR feels overwhelming until it is broken into questions. These are the ones worth answering first, and none of them needs a tool to answer - only somewhere to keep the answer.

What personal data do you collect, and where is it stored?Assets
Why do you process it, and on what lawful ground?Data Flows
Which vendors process data for you, and under what agreement?Third parties
Are your privacy notices clear and accessible?Policies
How do you handle a request from an individual?Projects
Which processing is high-risk enough to need a DPIA?Risk
Can you detect a breach and notify in time?Incidents
Who is responsible for data protection here?Organisation

The record is the evidence

A supervisory authority does not ask whether you have a privacy programme. It asks what you process, on what basis, and what you did to protect it. That is a record with links, not a policy document.

Because the flow points at controls and policies you already run for other frameworks, the GDPR work stops being a parallel project. The same endpoint encryption control that satisfies an ISO clause also protects a data flow, and it is tested once.

Navigating GDPR compliance with eramba - the full guide

Beyond the register

DPIA High-risk processing assessed in the Risk module, with the treatment attached to the flow it concerns.
Subject requests Handled as a project with an owner and a deadline, so the thirty-day clock is visible.
Breach response The incident record carries the timeline the seventy-two-hour notification is measured against.
Notices Privacy notices written, approved and published through the policy portal.

eramba was not built around GDPR

It was not built around any single regulation, and that is the point: the flexibility is what lets you structure GDPR inside it. But it means some things are plainly not ours.

eramba does not discover personal data on your network, does not manage cookie consent, and will not tell you which lawful basis applies. It records the decision you made, who made it, and the safeguard behind it - which is what a regulator asks to see.