GDPR (RODO)

The EU General Data Protection Regulation (2016/679). In force since 25 May 2018.

GDPR governs how organisations may collect and process personal data. Its key pillars are: the legal basis for processing (Art. 6), the rights of data subjects (access, rectification, erasure, objection), accountability, and the obligation to notify breaches within 72 hours.

In practice, GDPR compliance means maintaining several living documents and processes: a record of processing activities (RoPA), data protection impact assessments (DPIAs) for high-risk operations, handling of data subject requests, and a breach response procedure. In Poland, supervisory authority is exercised by the Polish DPA.

The most common mistake is treating GDPR as a one-time project. It is a continuous process: organisations change, data changes, and vendors change, so documentation must keep pace. Fines can reach EUR 20 million or 4% of total worldwide annual turnover.

In practice: see the relevant RealSec module.

RoPA

A register of all personal data processing operations carried out by a controller. Required under Art. 30 GDPR.

DPIA

A risk assessment of processing operations for the rights and freedoms of individuals. Required under Art. 35 GDPR when processing is likely to result in high risk.

Compliance that connects.

Terms are the map. RealSec ties them to processes, systems and vendors in one engine.

Book a demo → Back to the glossary