The GDPR as a Management System

Article 5(2) of the GDPR requires the controller to be able to demonstrate that processing meets the principles in Article 5(1): lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality. Demonstrate means a record. It does not mean a policy that says the principles are observed. Organisations outside the Union meet this duty only where they process personal data of individuals in the Union or are otherwise in scope. Organisations that do not process such data are not in scope of the GDPR.

What the duty asks for

In practice the duty is a set of operating processes. A lawful basis for every purpose. Records of processing under Article 30. A working process for data subject rights under Articles 15 to 22. A data protection impact assessment where Article 35 requires one. Processor contracts under Article 28. Security under Article 32. Breach notification to the supervisory authority within 72 hours where feasible, under Article 33, and communication to data subjects under Article 34 where the risk requires it.

Each of these has an owner, a trigger and a clock. A rights request starts a deadline. A breach starts a 72-hour clock from awareness. A retention period ends in a disposal decision. A list can note that these exist. It cannot run them.

What a list leaves unbuilt

Consent, rights, records of processing, DPIAs, retention and breaches are often run in separate tools and spreadsheets. The DPO then assembles a picture when the authority asks. That picture is a reconstruction. It does not show that the rights process ran, that the breach clock started from a recorded awareness time, or that disposal was approved by someone other than the person who requested it.

A privacy notice is not a system. A RoPA that was last touched at implementation is not a system. A DPIA template with empty fields is not an assessment. Accountability is the ability to show the process, not the ability to show the template.

How a management system meets it

A management system gives the DPO one hub. Consent, rights requests, records of processing, DPIAs, breach response, retention and assurance each run as a process with an audit trail. A breach record sets the notification deadline 72 hours from the base time. A rights request enters through a portal and is tracked. A RoPA is a sequence of steps, not a spreadsheet. Disposal goes through request, approval and execution, with a permanent log. Assurance items cover the Article 5 principles, with evidence and reviewer notes. Conducting, reviewing, approving, signing and exporting each need a separate permission.

AICOB is the process model the privacy processes sit on. The GDPR articles are mapped onto it where the organisation is in scope of them. The DPO platform is the environment. It does not replace the DPO. It gives the DPO a system of record. SI-specific controls under later EDPB and ICO guidance are a separate layer. The GDPR duty itself is already a management system. Organisations that are not in scope of the GDPR still benefit from the same process model for their own data-protection obligations under other laws.

The IT Governance platform for this system is available stand-alone, and on Nextcloud. Nextcloud is an open-source collaboration platform an organisation can host itself or have hosted. It adds file storage, user and group management, and federation, so a selected record can be shared with a group company, an authorised representative or a key supplier without consolidating every system into one. The process model is the same in both forms. Nextcloud is the environment the record stays in.