GDPR Compliance Platform & ISO 27701 PIMS

Frequently Asked Questions About GDPR

What is a ROPA, and why is it a legal requirement?

A ROPA (Record of Processing Activities) is a legal requirement under GDPR Article 30, obliging most organisations to maintain a detailed overview of what personal data they process, for what purpose, and who has access to it. It serves as the central documentation that a supervisory authority will request to see in the event of an investigation or a data breach.

What is the difference between a pre-DPIA and a full DPIA, and when is each triggered?

A pre-DPIA is a brief, initial screening that assesses whether a given processing activity is likely to pose a high risk to data subjects' rights. If the screening identifies such a risk, it triggers the requirement for a full DPIA (Data Protection Impact Assessment) under GDPR Article 35, which is a far more comprehensive risk assessment. Most organisations need both steps in their workflow, since conducting a full DPIA for every single processing activity is rarely necessary or proportionate.

How does NorthGRC handle third-country transfers and TIAs (Schrems II)?

Following the Schrems II ruling, organisations transferring personal data to countries outside the EU/EEA must conduct a Transfer Impact Assessment (TIA) to evaluate whether the recipient country's legislation provides an adequate level of protection. NorthGRC connects TIA assessments directly to your vendor and supplier data, making it automatically clear which third-party transfers require an assessment and which are already documented.

What fines can result from GDPR non-compliance?

GDPR operates with two tiers of administrative fines: up to €10 million or 2% of global annual turnover for less severe infringements, and up to €20 million or 4% of global annual turnover for the most serious infringements, whichever amount is higher. Beyond fines, non-compliance can also result in corrective orders from supervisory authorities, reputational damage, and compensation claims from data subjects whose rights have been violated.

How does NorthGRC handle GDPR and personal data compliance?

NorthGRC makes GDPR operational by automating the heaviest tasks. The platform serves as your central register of processing activities (Article 30), but goes a step further by guiding you through DPIAs with pre-built templates. If a breach occurs, the system includes a dedicated Incident Workbench that automatically generates the necessary tasks to notify authorities within the 72-hour deadline.

Can NorthGRC integrate GDPR with information security?

Absolutely. This is where NorthGRC truly stands out. Rather than having your DPO in one system and your CISO in another, we link GDPR controls directly to your ISO 27001 framework. This means that when you update a security control in one place, it is automatically reflected across both compliance records. This eliminates siloed work and ensures personal data compliance becomes a natural part of your overall information security.

What is ISO 27701, and how does it relate to GDPR?

ISO 27701 is an international standard for a Privacy Information Management System (PIMS) that extends ISO 27001 with specific requirements for handling personal data. The standard is not a legal requirement in itself, but it gives organisations a certifiable, structured framework to document GDPR compliance and demonstrate to customers and authorities that personal data protection is an integral part of their information security work.

Professional Privacy Governance Without the Administrative Burden

GDPR Compliance shouldn't be a manual uphill battle

One Platform. Shared Intelligence

Centralised documentation and follow-up across multiple entities

From statements to ongoing compliance

ISO 27001 certified in just 4 months

Simplifying NIS2 compliance without distracting from core business

1/1

Efficiency for the DPO

1. The Living ROPA

(Record of Processing Activities)

2. Integrated DPIA & TIA Workflows

3. Unified Breach Notification & Incident Response

Key Features for GDPR Compliance

Processing Activities

DPIA & TIA Management

Vendor & Processor Risk

Risk Management

Policy & Documentation

Dashboard & Reporting

Task & Planning

From Complexity to Privacy Clarity