> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://docs.brainframe.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# GDPR Management

# ⚖️ **GDPR Management**  
> **"Document processing, prove compliance, and manage privacy risks."**  
> *Stay aligned with GDPR obligations through structured records and dependencies.*  

One of the main challenges under strict privacy regulations such as the GDPR is ensuring that all **processing activities are properly documented**.  

Brainframe GRC provides dedicated templates and automation to streamline compliance, making it easier to maintain a **complete and auditable Record of Processing Activities (RoPA)**.  

---

## 1️⃣ Core Documentation Requirements  

When documenting a processing activity, you must include:  

* 👥 Relevant **data subjects**  
* 📂 **Nature** of data processed  
* 📜 **Legal basis** for processing  
* 🏢 Your **role** in the processing  
* 📥 **Data sources** and **storage locations**  
* 📤 **Recipients** of the data  
* 🗑 **Retention** and **disposal** procedures  

| 📌 Tip: Use Brainframe’s preconfigured templates to ensure none of these elements are overlooked.  

---

## 2️⃣ Dedicated Document Types  

Brainframe includes several **specialized document types** with built-in templates and automated behaviors to help you manage GDPR compliance efficiently.  

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/image-61_2by97u.png =242xauto)

### 📄 Data Processing Activity  

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/screenshot-2026-07-12-at-20414_1rrk486.png =1016xauto)
* Lets you **link or create related assets** such as suppliers, systems, or datasets.  
* Prompts you for **all relevant processing properties** (document properties) during creation.  
* Ensures your RoPA is **complete and compliant**.  

---

## 3️⃣ Visualizing Dependencies  

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/screenshot-2026-07-12-at-20424_141v0wx.png =671xauto)
* Use [**Linked Documents and the Dependency Tracker Graph**](https://docs.brainframe.com/en/article/dependency-tracking-1f1x6ax/) to see all connections between a processing activity and its related assets, risks, or agreements.  
* Understand **how data flows** internally and to third parties.  

---

## 4️⃣ Inventory of GDPR Data  

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/screenshot-2026-07-12-at-20433_1q07469.png =743xauto)
The [**Inventory Overview](https://docs.brainframe.com/en/article/inventory-overview-1plbnmr/) menu** lets you group GDPR-related data in a **consolidated view**.  

| 📌 Tip: Select the INBOX folder before opening the overview to see a full workspace-wide GDPR inventory.  

---

## 5️⃣ Global Dependencies  

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/screenshot-2026-07-12-at-20442_1yjzsle.png =344xauto)
* Use the [**Collections menu**](https://docs.brainframe.com/en/article/dependencies-j7a6sx/) to select **multiple processing activities**.  
* Visualize their **combined dependencies** across departments or systems.  
* Perfect for mapping **end-to-end data flows** in audits or DPIAs.  

---

## 6️⃣ Managing Suppliers  

Vendor risk management is a **critical GDPR obligation**. Brainframe provides:  

* A dedicated **Supplier or Subcontractor document type**.  
* Pre-built **vendor review templates**.  
* Structured storage of **contracts, Data Processing Agreements (DPAs), and validation checklists**.  

![](https://storage.crisp.chat/users/helpdesk/website/-/3/f/2/6/3f26ce462760bc00/screenshot-2026-07-12-at-20444_14yjed9.png =835xauto)
| 📌 Tip: Link each supplier to the [Risk](https://docs.brainframe.com/en/article/risk-management-1a6eibz/) menu to track and qualify privacy-related risks.  

---

## 7️⃣ Data Protection Impact Assessment (DPIA)  

A **DPIA is required** when:  

* Special categories of personal data are processed.  
* Processing is likely to pose **high risks** to data subjects’ rights and freedoms.  

Brainframe GRC provides:  

* A dedicated **DPIA document type**.  
* Ready-to-use templates for **risk evaluation and mitigation planning**.  

---

## 8️⃣ Best Practices  

* 🗂 **Use categories consistently** – Keep processing activities grouped by department or system.  
* 🔗 **Link dependencies** – Always connect suppliers, assets, and risks to processing activities.  
* 📜 **Update RoPA regularly** – Especially after adding new systems, vendors, or data flows.  
* 👥 **Assign clear ownership** – Every processing activity should have a responsible person.  
* 🚨 **Trigger DPIAs early** – Don’t wait until an auditor asks; assess risk before implementation.  

---

## 🎯 Visual Checklist  

* [x] All processing activities documented in RoPA  
* [x] Dependencies mapped in the graph view  
* [ ] Suppliers linked with contracts and DPAs  
* [ ] GDPR inventory exported for audit  
* [ ] DPIAs performed where high risks are present