Control map · Regulation (EU) 2016/679

GDPR

Code evidence for the processing principles, data protection by design and security of processing.

Book an audit pilot See a sample report

GDPR · Regulation (EU) 2016/6793 articles in scope · as mapped in v1.4.1

Code 3
Process 0
Planned 0

Code evidence

3articles checked on every pull request

Live (process)

0none mapped

Planned

0can be evidenced from code or GitHub; not built yet

Organisation-level articles

Policies, people, vendors, physical security and the like, listed below.Toevan gives supporting evidence for 1 of these.Managed by your organisation’s workflows

Some of the GDPR lives in code: where personal data flows, how it is scoped and how it is protected.

The GDPR blueprint gives code evidence for Articles 5, 25 and 32 on every pull request, with supporting evidence for erasure. Lawful basis, records of processing and data subject rights stay with your privacy programme.

Toevan gives evidence for controls; it never certifies them or claims a framework is covered. Whether the evidence is sufficient is your auditor’s judgement.

Code evidence3

Sealed on every pull request. Always partial: the control also asks for things outside code. Rules in the GDPR blueprint check part of each on every pull request.

Art.5Principles relating to processing of personal dataCore Principles
Art.25Data protection by design and by defaultDesign Requirements
Art.32Security of processingSecurity

Supporting1

Toevan records related evidence, but the duty is organisational, so it never counts as covered.

Art.17Right to erasure (‘right to be forgotten’)Data Subject RightsSupporting evidence: a rule records evidence related to this duty. The duty itself is an operational process.

Organisation-level articles

Organisation-level controls (policies, people, vendors, physical security and the like) stay with your organisation’s own process; Toevan does not cover them.

Show the list

Core Principles

Art.6Lawfulness of processingorganisational policy

Art.7Conditions for consentorganisational policy

Art.8Conditions applicable to child's consent in relation to information society servicesorganisational policy

Art.9Processing of special categories of personal dataorganisational policy

Art.10Processing of personal data relating to criminal convictions and offencesorganisational policy

Art.11Processing which does not require identificationorganisational policy

Data Subject Rights

Art.12Transparent information, communication and modalities for the exercise of the rights of the data subjectan operational process

Art.13Information to be provided where personal data are collected from the data subjectan operational process

Art.14Information to be provided where personal data have not been obtained from the data subjectan operational process

Art.15Right of access by the data subjectan operational process

Art.16Right to rectificationan operational process

Art.18Right to restriction of processingan operational process

Art.19Notification obligation regarding rectification or erasure of personal data or restriction of processingan operational process

Art.20Right to data portabilityan operational process

Art.21Right to objectan operational process

Art.22Automated individual decision-making, including profilingan operational process

Controller and Processor

Art.24Responsibility of the controllerorganisational policy

Art.26Joint controllersorganisational policy

Art.27Representatives of controllers or processors not established in the Unionorganisational policy

Art.28Processorcontracts and vendors

Art.29Processing under the authority of the controller or processororganisational policy

Art.30Records of processing activitiesorganisational policy

Art.31Cooperation with the supervisory authorityorganisational policy

Art.34Communication of a personal data breach to the data subjectregulatory procedure

Art.36Prior consultationorganisational policy

Art.37Designation of the data protection officerorganisational policy

Art.38Position of the data protection officerorganisational policy

Art.39Tasks of the data protection officerorganisational policy

Incident Response

Art.33Notification of a personal data breach to the supervisory authorityregulatory procedure

Risk Assessment

Art.35Data protection impact assessmentorganisational policy

International Transfers

Art.44General principle for transfersregulatory procedure

Art.45Transfers on the basis of an adequacy decisionregulatory procedure

Art.46Transfers subject to appropriate safeguardsregulatory procedure

Art.47Binding corporate rulesregulatory procedure

Art.48Transfers or disclosures not authorised by Union lawregulatory procedure

Art.49Derogations for specific situationsregulatory procedure

Using it in an audit

Read the code evidence for the period
Each pull request carries sealed code results against the blueprint’s rules, pinned to the commit and the rule-set version in force.
Test a sample
For each sampled record, check its results, then verify it offline against the published key with openssl and the shell: get the evidence, confirm the key, check the record. To replay the whole chain, Toevan provides the toevan command on request; it is not yet public.
The three steps, with the exact commands

How each fact was obtained6 labels

Recomputed: Toevan computed it from the code or git history itself.
Reported + sealed: GitHub reported it; Toevan captured it at the event and signed it.
Declared + sealed: The organisation declared it, such as a change to what is checked; Toevan signed the declaration and its history.
Toevan record, not sealed: Held in Toevan’s database but not sealed in the ledger, such as a waiver today. Nothing protects it by a signature.
Consumed: Taken from GitHub’s deployment and release records and linked by commit or digest.
Not captured: No reliable source was available. Toevan does not infer it.

The sample change evidence report shows the evidence as your auditor receives it, with every fact labelled.Open the sample report

Test the mapping on a real audit.

Bring one repository and an upcoming audit. We’ll set up the blueprint and walk your auditor through verification.

Book an audit pilot See a sample report

One repository, one framework
Evidence from the first pull request
Verifiable without a Toevan account