Control mapping available
GDPR
EU General Data Protection Regulation (GDPR)
GDPR sets principles for processing personal data and gives individuals rights over it. For engineering teams the practical work is records of processing, data protection impact assessments, processor contracts, transfer assessments, and appropriate security.
Applies to: Organizations that process personal data of people in the EU or EEA.
What to Know
- Article 30 requires records of processing activities (RoPA).
- Article 35 requires a DPIA for high-risk processing, which often includes new AI use cases.
- Chapter V governs transfers outside the EEA; transfer impact assessments (TIAs) document the risk.
Controls Lionhouse Helps With
The engineering-owned controls where continuous evidence saves the most time. Policies, training, and physical controls are tracked in trustlynce too.
| Reference | Control | How Lionhouse helps | Products |
|---|---|---|---|
| Art. 30 | Records of processing activities | trustlynce maintains the processing register alongside systems and vendors. | trustlynce |
| Art. 32 | Security of processing | Access reviews, vulnerability management, and monitoring evidence from TrustIvan, aiAxonIQ, and trustlynce show appropriate technical measures. | TrustIvan, aiAxonIQ, trustlynce |
| Art. 35 | Data protection impact assessment | trustlynce includes DPIA and TIA workflows with review and sign-off. | trustlynce |
| Art. 28 | Processors | trustlynce tracks data processing agreements and subprocessors. Self-hosting MITHUNAI and aiAxonIQ avoids adding new processors for AI and telemetry. | trustlynce, MITHUNAI, aiAxonIQ |
Lionhouse helps you prepare and maintain evidence. Your auditor or certification body makes the final determination.
Other Frameworks
Talk to an Architect
See the Four Products Running in Your Environment.
A technical session with a Lionhouse architect covering your stack, your deployment model, and a pilot plan.