English

Deutsch

English

Deutsch

Theme

Structure of the DS-GVO domain ​

Object and subtypes ​

Scope objects ​

  • Controller, Art. 4 No. 7 GDPR: For the documentation of the controller.

  • Processor: For the documentation of processors according to Art. 4 No. 8, 28 GDPR.

  • Client: For the documentation of clients for whom commissioned processing is carried out.

  • Joint controllers: Record joint controllers.

  • Scopes (general): For mapping other objects of consideration, such as projects.

Process objects ​

  • Processing activities: Documentation of the processing activities to build up the record of processing activities.

  • Data transfers: Recording of specific data transfers.

  • Data protection impact assessments: Data protection impact assessments carried out.

Asset objects ​

  • Data types: Information processed in processing activities, data transfers or applications.
  • Applications: Applications in which (personal) data is processed.
  • IT systems: Systems on or with which (personal) data is processed.

Personal objects ​

  • Data protection officers: To document the appointment of persons responsible for data protection.

  • Persons: Persons (groups) or roles.

Incident objects ​

  • Data protection incidents: For the documentation of incidents/occurrences.

Document objects ​

  • Contracts: For storing contracts.

  • Documents (general): For general documentation.

  • Requests from affected persons: For the documentation of requests from affected persons.

Control objects ​

  • TOMs: Generic technical-organizational measures.

Scenarios ​

  • Hazards: Data protection hazards for use in the risk analysis.

Catalog ​

The catalog of the GDPR domain provides basic technical-organizational measures and data protection threats.

Profiles ​

The Sample data profile creates a sample organization with all the important elements for mapping the GDPR in verinice. In your active unit, processing activities, processors, clients, data protection impact assessments, data protection incidents, data subject requests, TOMs and other sample objects are created in order to get to know verinice with all data protection-relevant functions.

Decisions ​

In the processing activity object, the requirement for a data protection impact assessment is supported by a decision.

Reports ​

The GDPR domain provides the following reports:

  • Directory of processing activities: A detailed overview of the processing activities carried out in a scope.

  • Data protection risk analysis: About the existing risks for the processing activities in a controller.

  • Data protection impact assessment: A list of information on data protection impact assessments carried out.

  • Contract processing pursuant to Art. 30 II GDPR: Documentation on the clients and processing activities carried out for them (contract processing).

  • Data subject request: A detailed presentation of a documented data subject request.

  • Overview of data subject requests: An overview of the documented data subject requests of a controller.

  • Data protection incident notification form: A detailed overview of the documented data protection incidents of a controller.

Risk definition ​

The standard risk definition Data Protection Risk Analysis (DSRA) contains the protection goals of confidentiality, integrity, availability and resilience.