Start free checkFree check Book a demo

GDPR · Regulation (EU) 2016/679

GDPR, article by article, with the records behind it.

Track the GDPR requirements, draw your processes and let your Article 30 register build from them, and run DPIAs, LIAs and TIAs with autofill and AI drafts.

Book a demoSee how the register builds
Requirements view for a demo company with GDPR 2016/679 selected: a compliance bar at 75 % (30 of 40 applicable) and the Article 5 principles from Art. 5.1.a lawfulness, fairness and transparency to Art. 5.2 accountability, each marked Compliant except Art. 5.1.f integrity and confidentiality, flagged as a Gap.
GDPR in Fidureon: each article with its status, and gaps flagged where the work is missing. Product screens show a fictional demo company.

The regulation in brief

What GDPR asks of you.

Six duties most organisations work on first, and where each one lives in Fidureon. A plain-language orientation, not legal advice.

  1. Art. 5(2)

    Show that you comply

    Accountability: you must be able to demonstrate that the principles are met, not just meet them.

    In FidureonEach requirement links to the controls, owners and evidence behind it, and records keep a change history.

  2. Art. 6

    Have a lawful basis

    Every processing activity needs a legal basis, such as contract, legal obligation, consent or legitimate interests.

    In FidureonSet the legal basis per process. For legitimate interests, run an LIA with the purpose, necessity and balancing tests.

  3. Art. 28

    Use processors under contract

    Processors acting for you need a data processing agreement with the terms the regulation sets out.

    In FidureonRecord DPA status on every supplier. It shows next to the supplier wherever its data appears in your register.

  4. Art. 30

    Keep records of processing

    Most organisations must keep a record of what they process, why, about whom, who receives it and for how long.

    In FidureonYour record of processing activities (ROPA) is built from your processes and information types, with CSV export.

  5. Art. 35

    Assess high-risk processing

    Where processing is likely to result in a high risk to people, assess it before you start.

    In FidureonRun a DPIA on the process: processing, necessity and proportionality, and mitigation measures with linked risks, then conclude.

  6. Art. 44–49

    Protect transfers outside the EEA

    Transfers to third countries need a transfer mechanism, and for many transfers an assessment of the destination’s laws.

    In FidureonRun a TIA per country: the transfer, the mechanism, the legal assessment, supplementary measures and a decision.

GDPR in Fidureon, in numbers.

40 Requirements GDPR Chapters II to V · catalogue
4 Chapters Art. 5 to 49 · II, III, IV, V
  • Chapter II · Art. 5–6 Principles 8
  • Chapter III · Art. 12–22 Rights of the data subject 11
  • Chapter IV · Art. 24–39 Controller and processor 17
  • Chapter V · Art. 44–49 Transfers to third countries 4

Article 30 · from the process canvas

Draw how you work. Your Article 30 register builds from it.

Create assets, information types and suppliers right on the canvas. The links fill themselves in, and your record of processing activities builds from them. No separate spreadsheet to keep in step.

  1. Draw

    Draw the process. Create the records right on the canvas.

    Drag steps and decisions onto the canvas, then the assets, information types, suppliers and AI systems each step uses. Every one of those nodes points to a real record in your registers. If an asset, information type or supplier does not exist yet, Quick Create makes it and links it in one step; AI systems link to entries already in your AI register. Drawing a box on its own never adds a row to a register.

    The first part of the Meter-to-cash (billing) process diagram: Start, the steps Collect hourly readings and Validate and estimate gaps, an Anomaly? decision, a Field inspection step and Calculate invoice, each connected to the records it uses: the input Meter reading, the assets Smart meter head-end and ERP (finance & purchasing), the Confidential information type Hourly consumption data, the AI system Meter anomaly detection (Minimal Risk) and the suppliers Mätpunkt Data AB and Norrsken Cloud AB.
    Part of a real process diagram: every coloured node is a record in a register.
    Quick Create Information Type dialog opened from a new node on the process canvas: name “Field inspection photos”, data classification confidentiality Confidential, integrity Medium, availability Medium, and a Create & Link button; the node’s side panel offers “Create new info type”.
    Quick Create makes the information type, with its classification, and links it to the node.

    Create & Link

    Name the record, set what the dialog asks for (for an information type, its confidentiality, integrity and availability) and choose Create & Link. The record now exists in its register and the node points to it.

    Quick Create covers assets, information types and suppliers. An AI system on the canvas links to one already in your AI register.

    Prefer a first draft? The AI Process Builder, marked Experimental in the product, can sketch the diagram for you and links only records that already exist.

  2. Save

    Save, and the links fill themselves in.

    When you save, the process is linked to every record on its diagram. The edges link assets to the information types they hold and suppliers to the assets they run. Switch on personal-data processing for the process and it carries a GDPR badge.

    The Meter-to-cash (billing) process card in a demo company’s process list: Active, a GDPR badge, a description of meter reading, validation, billing and payment handling, owner CFO and “2 assets · 3 data” derived from its diagram.
    A process marked as personal-data processing, with what its diagram links.
    Information Types register for a demo company: Customer billing details, Hourly consumption data and Payment and invoice history, each Customer Data, Confidential, with an owner and the number of assets it is linked to.
    Information types with their classification, owner and the assets linked to them.Information types, each with what it holds.

  3. Register

    Your Article 30 register builds from them.

    Every process marked as personal-data processing appears in the register with its purpose, the information types that hold personal data, how long each is kept and the suppliers that process it, with their DPA status. Change the process and the register follows. Export it as CSV whenever someone asks.

    The Article 30 register entry for the Meter-to-cash (billing) process, owner CFO, Active, 3 PII types: processing purpose “Meter reading, billing and payment collection for electricity and grid customers”, then the PII information types, the first being Hourly consumption data with a retention of 3 years and the supplier processing it, Mätpunkt Data AB, with its DPA In Place.
    1. Why the data is processed, kept on the process itself.
    2. The information types linked on the canvas that hold personal data.
    3. How long each information type is kept.
    4. The supplier that processes this data, with its data processing agreement status.
    1. Purpose. Why the data is processed, kept on the process itself.
    2. Personal data. The information types linked on the canvas that hold personal data.
    3. Retention. How long each information type is kept.
    4. Processor and DPA. The supplier that processes this data, with its data processing agreement status.
    One record of processing, built from the process and the records linked to it.

Around the register

Processors, breaches and the questions you ask suppliers.

The work that keeps the register honest happens in the same place. These are the real screens.

Art. 28Processors

Every processor in one supplier register.

Keep each supplier with the service it provides, an owner and an assessment status, as in the list here. On each supplier record you also note whether a data processing agreement is in place, not in place or not required, and your Article 30 register then shows that DPA status beside every processor that handles the data.

Supplier register of a demo company listing Atlas LLM Inc. (a US-based large-language-model API), Byggnät Entreprenad AB, Fjärrnät Telecom AB, GridSense Systems Oy and Kundvägen CRM AB, each with what it does, an owning role and an assessment status of Assessed or Not Assessed.
  1. A US-based model API used by a customer assistant. Transfers like this are what a TIA is for.
  2. A responsible role for each supplier relationship.
  3. Assessed or not assessed, so unchecked processors stand out.
  1. A processor outside the EU. A US-based model API used by a customer assistant. Transfers like this are what a TIA is for.
Suppliers with the service they provide, an owner and an assessment status.

Art. 33–34Breaches

Personal data breaches, documented.

Log a breach the way you log any incident: what happened, when it was detected, who owns it, and its status from draft to closed. Notifications to the supervisory authority and to the people affected go through your own channels.

Incident register of a demo company with four incidents, newest first: suspicious login attempts (Draft), a phishing campaign (Logged), a fibre cut (Closed) and misdirected invoice e-mails to 412 customers, owned by the Data Protection Officer (Closed).
  1. Invoices e-mailed to the wrong customers, logged like any other incident.
  2. An owning role and the person handling it, here the Data Protection Officer.
  3. Each incident moves from draft to logged to closed.
  1. A personal data breach. Invoices e-mailed to the wrong customers, logged like any other incident.
  2. Owner. An owning role and the person handling it, here the Data Protection Officer.
The incident register: detection date, owner and a draft-to-closed lifecycle.
A question in the supplier-facing questionnaire: “Which certifications or attestation reports do you hold?”, with ISO 27001, ISO 22301 and SOC 2 Type II ticked.

Ask processors the right questions

Send a security questionnaire with AI-generated questions. Suppliers answer in a hosted page, no account needed.

A supplier’s submitted answers, 10 of 10 answered: Yes to ISO/IEC 27001 certification, and ISO 27001, ISO 22301 and SOC 2 Type II as the certifications held.

Their answers, back with you

Every answer lands in one place, ready to review and to export as CSV.

DPIA, LIA and TIA

Drafted with AI. Decided by you.

Every assessment starts from the linked process. What is already known is filled in, AI drafts the narrative, your DPO can advise, and the accountable owner records the outcome.

  1. You

    Start from the process

    Open a DPIA or LIA on a process, or a TIA on a transfer you mapped.

  2. Fidureon

    Known fields filled in

    Whatever is already known from the linked process is filled in for you.

  3. AI

    AI drafts the narrative

    Such as a balancing test or a preliminary legal assessment. Marked as AI-drafted, always editable.

  4. DPO

    Your DPO advises

    Your DPO can advise before a decision is made. The advice does not decide.

  5. Owner

    The owner decides

    The accountable owner records the outcome. It is never AI-generated.

Diagram, not a product screen: the path a DPIA, LIA or TIA takes.

  • DPIAArt. 35

    Data protection impact assessment

    For processing likely to result in a high risk to people.

    Covers

    • Processing and the data involved
    • Necessity and proportionality
    • Mitigation measures, with linked risks

    Owner decidesResidual risk level and any conditions

  • LIAArt. 6(1)(f)

    Legitimate interests assessment

    When legitimate interests is your legal basis.

    Covers

    • Purpose test
    • Necessity test
    • Balancing test

    Owner decidesProceed, proceed with safeguards or do not proceed

  • TIAArt. 44–49

    Transfer impact assessment

    For each transfer of personal data to a third country.

    Covers

    • Know your transfer
    • Legal assessment (Schrems II)
    • Supplementary measures
    • Review date, suspend and resume

    Owner decidesApprove, approve with measures, suspend or reject

Hosting and AI

Fully EU-based.

Fidureon is built and operated by CShift AB in Göteborg and hosted on Google Cloud in the EU: europe-north1 (Finland) is the primary region, and evidence files are replicated every day to europe-north2 (Stockholm). The AI runs on models hosted in EU data centres: Google’s models on Vertex AI in the EU, and selected flows on Mistral, a European AI company.

How we handle data and AI
Primary region
europe-north1 Finland
Evidence-file backups
europe-north2 Stockholm
Database backups
Point-in-time recovery Google Cloud EU
AI
Vertex AI EU region
AI
Mistral EU hosting

Works with your other frameworks

GDPR and the rest, from the same work.

Link a control to each requirement it meets, by hand or with AI suggestions on import, and the same work counts toward GDPR, ISO 27001, the EU AI Act and the other frameworks you run.

For example, one supplier security assessment can count toward GDPR Art. 28 and ISO 27001 A.5.19 once you link it to both.

How one control counts across frameworks
Framework readiness card on the dashboard of a demo company: ISO 27001:2022 ISMS 77 %, ISO 9001:2015 QMS 69 %, GDPR 75 % and EU AI Act 35 %, each with a progress ring and its readiness across one entity.
GDPR beside ISO 27001, ISO 9001 and the EU AI Act on the same dashboard, each with its own readiness.

FAQ

GDPR questions.

Does using Fidureon make us GDPR compliant?

No tool can do that on its own, and Fidureon is not a certification. Compliance depends on how you process personal data. Fidureon gives you the 40 requirements from Chapters II to V, the Article 30 register, DPIA, LIA and TIA workflows and the evidence behind each requirement, so you can show your work.

How is the Article 30 register built?

From the processes you draw. On the process canvas, each step links to the assets, information types and suppliers it uses, and you can create a missing record right there with Quick Create. When you save, the links are filled in for you. Mark the process as personal-data processing and it appears in the register with its purpose, data subjects, data categories, recipients, retention, the suppliers that process the data and their DPA status, third-country transfers, security measures and legal bases. This is your record of processing activities (ROPA). Export it as CSV.

Does AI write our DPIAs, LIAs and TIAs?

It drafts, you decide. Fields that are known from the linked process are auto-filled, and AI can draft the narrative, such as a balancing test or a preliminary legal assessment for a transfer. AI-drafted fields are marked and stay editable. The outcome, such as a transfer decision, is recorded by the accountable owner and is never AI-generated.

Where is our data hosted, and where does AI processing happen?

Hosted in Google Cloud europe-north1 (Finland), with a daily copy of evidence files in europe-north2 (Stockholm). Database backups stay in Google Cloud’s EU locations. The AI runs on models hosted in EU data centres: Google’s models on Vertex AI in the EU, and selected flows on Mistral, a European AI company.

Does Fidureon handle data subject requests and breach notifications?

Not as dedicated workflows. The catalogue includes the data subject rights in Chapter III and the breach requirements in Articles 33 and 34, so you can link the controls, policies and evidence that meet them, and incidents are recorded in the incident log. Requests from data subjects and notifications to the supervisory authority are handled through your own channels.

We also work with ISO 27001 or NIS2. Do we do the work twice?

No. A control can be linked to requirements in several frameworks at once. A supplier security assessment, for example, can count toward GDPR Article 28, ISO 27001 A.5.19 and Cybersäkerhetslagen 2:3.4. You decide the links yourself, with AI suggestions when you import controls from documents or spreadsheets.

More on hosting, sub-processors and AI processing: Security

Put your GDPR records in order.

Book a demo and we will walk through your register, assessments and suppliers using your own processes. Working on ISO 27001 or the EU AI Act as well? Start with the free readiness check.

Book a demoStart free readiness check