GDPR software for your
data protection management

The General Data Protection Regulation (Regulation (EU) 2016/679, in German DSGVO) is the data protection law of the European Union. It has applied directly in all Member States since 25 May 2018 and governs the conditions under which personal data may be processed, which rights data subjects have and which duties fall on controllers and processors. In Germany the Federal Data Protection Act (BDSG) supplements it.

A data protection management system (DPMS) is the whole of the rules, processes, roles and evidence with which an organisation complies with the GDPR and can prove it. It covers the record of processing activities, the legal bases, the technical and organisational measures, the handling of requests and incidents and the regular review.

GDPR software maps the requirements of the regulation as a catalogue and links them to what they refer to — processing activities, systems, data categories, service providers, persons. The recurring activities run as tasks with workflow and deadline, and the record, the DPIA report and the incident documentation arise from the data rather than in spreadsheets.

The Data Protection Kit is the prepared starting set of the Complaica DPMS software: a typical organisational structure, a record template under Art. 30, DPIA assessment and report, and threat and measure catalogues. This page describes the functions and workflows of the GDPR software; the page on the DPMS software presents the contents of the Kit.

Ten task types with a workflow of their own: processing activity (PA), data subject request (DSR), complaint (CMP), data privacy incident (DPI), DPIA threshold assessment (TA), data protection impact assessment (DPIA), transfer impact assessment (TIA), consent record (CR), legitimate interest assessment (LIA) and confidentiality commitment (CC). Plus processor review, security incident and lesson learned.

Under Art. 12(3) GDPR without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests; the data subject must be informed of any such extension within one month of receipt, together with the reasons for it. In Complaica every request carries its deadline, and the dashboard shows what is due.

Under Art. 33(1) GDPR the controller notifies a personal data breach to the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it — unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification is not made within 72 hours, it is accompanied by reasons for the delay. A processor notifies the controller without undue delay. Where the breach is likely to result in a high risk, it must also be communicated to the data subjects without undue delay under Art. 34. Under Art. 33(5) every breach is documented.

Under Art. 35 GDPR, where a processing — in particular using new technologies — is likely to result in a high risk to the rights and freedoms of natural persons. Art. 35(3) names in particular a systematic and extensive evaluation of personal aspects, including profiling, on which decisions producing legal effects are based; processing on a large scale of special categories of data or of personal data relating to criminal convictions and offences; and a systematic monitoring of a publicly accessible area on a large scale. The supervisory authorities publish lists under Art. 35(4). Whether a DPIA is required is settled in Complaica by the threshold assessment per processing activity.

The assessment of whether a transfer of personal data to a third country is permissible: which instrument of Chapter V applies — adequacy decision, standard contractual clauses, binding corporate rules —, whether the law of the destination country impairs the protection and which supplementary measures are needed. The Court of Justice of the European Union required this assessment in its Schrems II judgment (C-311/18). In Complaica the TIA is a task type with a review date.

Under Art. 7(1) GDPR the controller must be able to demonstrate that the data subject has consented. Under Art. 7(3) consent can be withdrawn at any time, and withdrawing must be as easy as giving it. Complaica runs consents as tasks with the statuses Active, Withdrawn and Expired, linked to the processing activity that relies on them.

The test of whether a processing can rest on legitimate interest under Art. 6(1)(f) GDPR: is there a legitimate interest, is the processing necessary for it, and are the interests or fundamental rights of the data subject not overriding? The result is documented — in Complaica as a task that hangs on the processing activity.

Persons acting under the authority of the controller or of the processor who have access to personal data may process them only on instructions (Art. 29, Art. 32(4)); under Art. 28(3)(b) the persons authorised by a processor to process the data must have committed themselves to confidentiality. The written confidentiality commitment is the usual evidence of this. Complaica runs it per person: sent, signed, expired or refused, with document and date.

A deletion concept sets out when which personal data is deleted, and how. Data categories are assigned to deletion rules — with a starting point and a period, derived from the purpose and from statutory retention obligations —, and deletion units describe in which system and at which granularity the data is deleted. The method is described in DIN EN ISO/IEC 27555:2025-09, which replaced DIN 66398 in September 2025. In the GDPR it rests on storage limitation (Art. 5(1)(e)), the right to erasure (Art. 17) and the time limits for erasure in the record (Art. 30(1)(f)).

Under Art. 30 GDPR every controller and every processor. Art. 30(5) exempts enterprises and organisations employing fewer than 250 persons — but not where the processing they carry out is likely to result in a risk to the rights and freedoms of data subjects, is not occasional, or includes special categories of data as referred to in Art. 9(1) or personal data relating to criminal convictions and offences referred to in Art. 10. In Complaica the record arises from the approved processing activities as a report.

The German Federal Data Protection Act uses the opening clauses of the GDPR. Among other things, Section 38 BDSG requires a data protection officer to be designated where, as a rule, at least twenty persons are permanently engaged in the automated processing of personal data, or where processing is carried out that is subject to a data protection impact assessment. In Complaica the BDSG is assessed as a requirement catalogue of its own beside the GDPR.

Yes, as an additional service. Our data protection experts take on the role under Art. 37 GDPR and Section 38 BDSG — as the contact for the supervisory authority, data subjects and management, with Complaica as the working tool. Beyond that we advise on gap analysis, the record, DPIA, processing on behalf and training.