Regulation (EU) 2016/679
Spreadsheets do not stand up to a supervisory authority. DP Systems is the controller- and processor-facing system of record for personal data: principles and lawful bases, records of processing, data subject rights, DPIA, breaches, and transfers — with the data protection officer in the work, not in a side channel.
Duties
Regulation (EU) 2016/679 is not a policy folder. It is a set of operational duties over personal data: the controller must be able to demonstrate compliance; the processor acts on documented instructions; the data protection officer informs, advises, and monitors. DP Systems organises that work as live operations — not as a completed checklist with no evidence behind it.
Implements appropriate measures, keeps records of processing, seeks the DPO’s advice on DPIA, and is able to demonstrate that processing is performed in accordance with the Regulation.
Processes personal data only on the controller’s documented instructions. Written contract, sub-processor flow-down, and a record of categories of processing carried out on behalf of each controller.
Informed and involved in a timely manner. Advises on DPIA, monitors compliance, cooperates with the supervisory authority, and remains independent — not instructed on those tasks.
Operations
Domain work covers the articles a controller or processor must implement. Automated processing and AI is treated as a GDPR extension of those same articles — training, inference, model hosts, and solely automated decisions — not as a separate statute.
Arts 5–11. Lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality, and accountability. Lawful bases, consent, children, special categories, and criminal data.
Lawful basis, purpose limitation, and data minimisation apply to training and inference. Special categories of personal data in models need an Art 9(2) exception.
Arts 12–23. Transparent information, access, rectification, erasure, restriction, portability, objection, automated decisions, and documented restrictions. Act without undue delay and at the latest within one month.
Data subjects retain Arts 12–22 rights over personal data used in AI systems, including access, erasure, objection, and Art 22 safeguards for solely automated decisions.
Arts 24–31. Controller responsibility, data protection by design and by default, joint controllers, representatives, processor contracts, records of processing activities (ROPA), and cooperation with the supervisory authority.
Art 28 processor terms for model hosts. Art 30 records must cover each processing purpose, including AI processing purposes, recipients, transfers, retention, and a general description of security measures.
Arts 32–34. Appropriate security of processing. Notify the supervisory authority without undue delay and, where feasible, not later than 72 hours. Communicate a high-risk breach to the data subject without undue delay — that notice is not the same as the Art 33 notice.
For AI systems, Art 32 includes controls against prompt and output leakage of personal data, model inversion, and unauthorised access to training sets.
Arts 35–36. Where a type of processing is likely to result in a high risk to rights and freedoms, the controller must, prior to the processing, carry out a data protection impact assessment and seek the advice of the data protection officer, where designated.
Art 36 prior consultation applies where residual high risk remains after measures taken by the controller.
Arts 37–39. Designation where required; independent position; tasks to inform and advise, monitor compliance, advise on DPIA, cooperate with the supervisory authority, and act as contact point. A group may appoint a single DPO if easily accessible from each establishment.
The DPO monitors AI processing, advises on DPIAs for new models, and must not receive instructions on those tasks.
Chapter V. Adequacy decisions, appropriate safeguards including standard contractual clauses, binding corporate rules, and narrow Art 49 derogations. Derogations are occasional, not a standing programme.
Personal data sent to a model host or training facility in a third country is a Chapter V transfer. Document the safeguard and, where Art 46 is used, the transfer impact assessment.
The same Regulation, applied to training, inference, model hosting, and solely automated decisions: Arts 5, 6, 9, 22, 28, 30, 32, 35, and 44–49.
Where Art 22 applies, suitable measures include human intervention, the right to express views, and the right to contest the decision. Oversight must be able to change the outcome.
Registers
Operational records are not enough on their own. The workbench includes organisation-wide registers so the data protection officer and management can see how authorities and the real world have treated similar processing.
A register of EU and UK GDPR decisions, ordered by GDPR Article, with a most-recent panel, court and DPA details, holdings, and source links. Sourced from GDPRhub (noyb) and kept as operational awareness — not a substitute for reading the original authority publication.
A register of real-world AI incidents from the AI Incident Database (Responsible AI Collaborative), deduplicated to one row per incident and limited to incident reports. Grouped by harm type, with a most-recent panel and source links.
Who it is for
Accountability under Art 5(2) and Art 24 is residual. The system produces the records management needs to direct processing, review high-risk DPIAs, and know when a breach or a data-subject request is open.
A place to be involved, properly and in a timely manner, in issues which relate to the protection of personal data: advise on DPIA, monitor the article work, and remain the contact point for the supervisory authority.
Lawful-basis registers, ROPA, processor contracts, data-subject request handling, 72-hour breach clocks, and transfer files — structured so the next review does not start from a mailbox search.
Contact
Whether you are standing up a records-of-processing programme, putting the DPO into DPIA work, or treating AI processing as GDPR processing, we can walk through how DP Systems holds that work.
Institute: aiassurance.institute
No street address is published on this site. Enquiries are handled by email.
Send a data-protection enquiry. If the form cannot send, use the email link.
Prefer email? info@dp.systems