Skip to content
toevan
Sign inBook an audit pilot
Open menuClose menu
Book an audit pilot

Control map · Regulation (EU) 2016/679

GDPR

Book an audit pilotSee a sample report

3 of 3 GDPR controls code can evidence, with v1.4.0, plus 2 supporting

Code evidence for the processing principles, data protection by design and security of processing.

  • Live3
  • Coming in v1.4.00
  • Supporting2
  • Planned0
  • Your organisation35
  1. 3 with code evidence todayPartial evidence, checked on every pull request.
  2. 2 with supporting evidenceToevan records related evidence; the duty stays organisational.
  3. 35 stay with your organisationListed in full below, so nothing is implied.

Some of the GDPR lives in code: where personal data flows, how it is scoped and how it is protected.

The GDPR blueprint gives code evidence for Articles 5, 25 and 32 on every pull request, with supporting evidence for erasure and breach notification. Lawful basis, records of processing and data subject rights stay with your privacy programme.

Toevan gives evidence for controls; it never certifies them or claims a framework is covered. Whether the evidence is sufficient is your auditor’s judgement.

Live3

Code evidence today, sealed on every pull request. Always partial: the control also asks for things outside code. Code evidence today: rules in the GDPR blueprint check part of this on every pull request.

  • Art.5

    Principles relating to processing of personal data

    Core Principles

  • Art.25

    Data protection by design and by default

    Design Requirements

  • Art.32

    Security of processing

    Security

Supporting2

Toevan records related evidence, today or in v1.4.0, but the duty is organisational, so it never counts as covered.

  • Art.17

    Right to erasure (‘right to be forgotten’)

    Data Subject Rights

    Supporting evidence today: a rule records evidence related to this duty. The duty itself is an operational process.

  • Art.33

    Notification of a personal data breach to the supervisory authority

    Incident Response

    Supporting evidence today: a rule records evidence related to this duty. The duty itself is regulatory procedure.

Your organisation35

Policy, people, physical security, contracts, regulatory procedure, operations or external audit. Your organisation evidences these.

Show all 35 controls

Core Principles

  • Art.6Lawfulness of processingorganisational policy
  • Art.7Conditions for consentorganisational policy
  • Art.8Conditions applicable to child's consent in relation to information society servicesorganisational policy
  • Art.9Processing of special categories of personal dataorganisational policy
  • Art.10Processing of personal data relating to criminal convictions and offencesorganisational policy
  • Art.11Processing which does not require identificationorganisational policy

Data Subject Rights

  • Art.12Transparent information, communication and modalities for the exercise of the rights of the data subjectan operational process
  • Art.13Information to be provided where personal data are collected from the data subjectan operational process
  • Art.14Information to be provided where personal data have not been obtained from the data subjectan operational process
  • Art.15Right of access by the data subjectan operational process
  • Art.16Right to rectificationan operational process
  • Art.18Right to restriction of processingan operational process
  • Art.19Notification obligation regarding rectification or erasure of personal data or restriction of processingan operational process
  • Art.20Right to data portabilityan operational process
  • Art.21Right to objectan operational process
  • Art.22Automated individual decision-making, including profilingan operational process

Controller and Processor

  • Art.24Responsibility of the controllerorganisational policy
  • Art.26Joint controllersorganisational policy
  • Art.27Representatives of controllers or processors not established in the Unionorganisational policy
  • Art.28Processorcontracts and vendors
  • Art.29Processing under the authority of the controller or processororganisational policy
  • Art.30Records of processing activitiesorganisational policy
  • Art.31Cooperation with the supervisory authorityorganisational policy
  • Art.34Communication of a personal data breach to the data subjectregulatory procedure
  • Art.36Prior consultationorganisational policy
  • Art.37Designation of the data protection officerorganisational policy
  • Art.38Position of the data protection officerorganisational policy
  • Art.39Tasks of the data protection officerorganisational policy

Risk Assessment

  • Art.35Data protection impact assessmentorganisational policy

International Transfers

  • Art.44General principle for transfersregulatory procedure
  • Art.45Transfers on the basis of an adequacy decisionregulatory procedure
  • Art.46Transfers subject to appropriate safeguardsregulatory procedure
  • Art.47Binding corporate rulesregulatory procedure
  • Art.48Transfers or disclosures not authorised by Union lawregulatory procedure
  • Art.49Derogations for specific situationsregulatory procedure

Using it in an audit

  1. Read the code evidence for the period

    Each pull request carries sealed code results against the blueprint’s rules, pinned to the commit and the rule-set version in force.

  2. Test a sample

    For each sampled record, check its results, then verify its signature and its place in the chain offline.

    toevan audit verify --path evidence-clone --pub-key toevan.pub

How each fact was obtained

Every fact in a record and a report carries one of six labels, so your auditor knows how far to rely on it.

Recomputed
Toevan computed it from the code or git history itself.
Re-perform it from the same inputs and get the same result.
Reported + sealed
GitHub reported it; Toevan captured it at the event and signed it.
Rely on it as far as you rely on GitHub. Any later change is detectable.
Declared + sealed
The organisation declared it, such as a change to what is checked; Toevan signed the declaration and its history.
See who declared what, when, and every later change.
Toevan record, not sealed
Held in Toevan’s database but not sealed in the ledger, such as a waiver today. Nothing protects it by a signature.
Treat it as Toevan’s statement, and ask the organisation for the approval behind it.
Consumed
Taken from another system’s signed record, such as build provenance, and linked by commit or digest. Planned.
Check the original record independently.
Not captured
No reliable source was available. Toevan does not infer it.
Obtain it from the organisation by other means.

See it in a report

The sample change evidence report shows the evidence as your auditor receives it, with every fact labelled.

Open the sample report

Test the mapping on a real audit.

Bring one repository and an upcoming audit. We’ll set up the blueprint and walk your auditor through verification.

Book an audit pilotSee a sample report