Controllers
Anyone deciding why and how personal data is processed. Deploy an AI system on customer, employee or applicant data and you are its controller.
WHO IT APPLIES TO
Who must comply with the GDPR
It binds by role, whatever the sector. Your EU AI Act role does not change who is the controller.
Processors
Anyone processing on a controller's instructions, under an Art. 28 contract. A provider hosting or fine-tuning a model on customer data usually is one.
Organisations outside the EU
Art. 3 reaches anyone offering goods or services to people in the EU or monitoring their behaviour, wherever established. Art. 27 then asks for an EU representative.
KEY DATES · STATUS
The dates that matter
No certificate is required. Art. 42 schemes exist, are voluntary, and are never issued by Veritome.
| Date | Event | What it means |
|---|---|---|
| 27.04.2016 | Adopted | Adopted by the Parliament and the Council. |
| 24.05.2016 | In force | Twenty days after publication in the Official Journal. |
| 25.05.2018 | Applies | Applicable in every member state, with no transition remaining. |
| 02.08.2026 | EU AI Act Art. 50 | The EU AI Act's transparency duties apply, on top of the GDPR's own Art. 13 and 14 notices. |
| 02.12.2027 | EU AI Act Annex III | A deployer of a high-risk system uses the provider's Art. 13 information for its GDPR Art. 35 DPIA (EU AI Act Art. 26(9)). |
WHAT IT ASKS
61 requirements, in the shape the regulation gives them
The 61 articles and paragraphs the 19 organisation duties close in the owner-verified matrix, not the whole regulation. The titles are the articles' own headings; the GDPR is public law.
61
article-level references
48
distinct articles
The 61 references, with the regulation's own headings
- Art. 2Material scope
- Art. 3Territorial scope
- Art. 5(1)(a)Lawfulness, fairness and transparency
- Art. 5(1)(b)Purpose limitation
- Art. 5(1)(c)Data minimisation
- Art. 5(1)(d)Accuracy
- Art. 5(1)(e)Storage limitation
- Art. 5(1)(f)Integrity and confidentiality
- Art. 5(2)Accountability
- Art. 24Responsibility of the controller
- Art. 25Data protection by design and by default
- Art. 37Designation of the data protection officer
- Art. 38Position of the data protection officer
- Art. 39Tasks of the data protection officer
- Art. 4(7)Definition of controller
- Art. 4(8)Definition of processor
- Art. 26Joint controllers
- Art. 30Records of processing activities
- Art. 6Lawfulness of processing
- Art. 9Processing of special categories of personal data
- Art. 10Processing of personal data relating to criminal convictions and offences
- Art. 89(1)Safeguards for archiving, research and statistical purposes
- Art. 35Data protection impact assessment
- Art. 36Prior consultation
- Art. 32(1)Security of processing — appropriate technical and organisational measures
- Art. 32(2)Security of processing — assessing the risks
- Art. 32(3)Security of processing — approved codes and certification as evidence
- Art. 33Notification of a personal data breach to the supervisory authority
- Art. 34Communication of a personal data breach to the data subject
- Art. 11Processing which does not require identification
- Art. 12Transparent information, communication and modalities for exercising rights
- Art. 15Right of access by the data subject
- Art. 16Right to rectification
- Art. 17Right to erasure
- Art. 18Right to restriction of processing
- Art. 19Notification obligation regarding rectification, erasure or restriction
- Art. 20Right to data portability
- Art. 21Right to object
- Art. 22Automated individual decision-making, including profiling
- Art. 28Processor
- Art. 13Information to be provided where data are collected from the data subject
- Art. 14Information to be provided where data have not been obtained from the data subject
- Art. 29Processing under the authority of the controller or processor
- Art. 32(4)Persons acting under authority process only on instructions
- Art. 39(1)(b)DPO monitoring, awareness-raising and training
- Art. 24(1)Measures implemented, reviewed and updated
- Art. 4(11)Definition of consent
- Art. 7Conditions for consent
- Art. 8Conditions applicable to child's consent in relation to information society services
- Art. 27Representatives of controllers or processors not established in the Union
- Art. 44General principle for transfers
- Art. 45Transfers on the basis of an adequacy decision
- Art. 46Transfers subject to appropriate safeguards
- Art. 47Binding corporate rules
- Art. 48Transfers or disclosures not authorised by Union law
- Art. 49Derogations for specific situations
- Art. 31Cooperation with the supervisory authority
- Art. 40Codes of conduct
- Art. 41Monitoring of approved codes of conduct
- Art. 42Certification
- Art. 43Certification bodies
HOW VERITOME RUNS IT
19 organisation duties in 5 groups, one record each
Binding law, and never a gate on the EU AI Act. It runs in two places: on each AI system, and as an optional organisation programme.
- Per system: lawful basis, notices, Art. 22 safeguards and a DPIA sit beside its EU AI Act obligations, with their own count.
- Generated for every system that processes personal data. Never a switch, never holding an EU AI Act stage open.
- Organisation: 19 duties you switch on under Frameworks, free on every plan, grouped Establish · Map · Protect · Operate plus Conditional / specialist.
- The groups are for reading, not gates: nothing is locked. 3 conditional duties start as not applicable until the fact holds on your register.
Outside the line
Conditional / specialist holds 5 duties that never lock or block a phase. 3 open on a fact from your register; until it holds, or a person flips one, each stays not applicable:
- Consent and children’s online-service consent: Applies when processing relies on consent, including children's online services
- International transfers and safeguards: Applies when personal data leaves the EU/EEA
- Approved codes and certification (conditional): Applies when the organisation joins an approved code of conduct or certification scheme
WHERE IT OVERLAPS
Credited in both, or only related
No GDPR duty is credited against another framework: the owner-verified matrix found no clause it could check as identical. Related links are shown as supporting reading, never counted.
GDPREstablishArt. 2 · Art. 3 · Art. 5(1)(a)–(d)
Accountability and privacy governance policyDone
Credited in no other programme: every link below is shown, never counted.
Across the programme
17 related
16 related
11 related
4 related
Related work, shown and never counted
Illustrative progress · the steps and counts are the product’s
10 of the 19 steps carry a related link to an EU AI Act article. A related link was not checked against source text by the owner's verified matrix, so it is shown and never counted. Credit shows in three places only:
- “Also counts toward” on a record
- “Credited by work already on file” on a step that is Done
- one figure on each programme card
See all three on the frameworks page, and the EU AI Act article by article at /eu-ai-act.
| With | Records credited in both | Related only: shown, never credited | Page |
|---|---|---|---|
| EU AI Act | 0 | 17 | EU AI Act → |
| ISO 42001 | 0 | 16 | ISO 42001 → |
| ISO 27001 | 0 | 11 | ISO 27001 → |
| NIST AI RMF | 0 | 4 | NIST AI RMF → |
QUESTIONS PEOPLE ASK
GDPR, answered plainly
The same answers, word for word, that the page marks up for search engines and AI assistants.
Does the EU AI Act replace the GDPR for AI systems?
No. The EU AI Act applies without prejudice to the GDPR, so an AI system that processes personal data answers to both. The EU AI Act adds duties by role and risk tier; the GDPR keeps its lawful-basis, transparency, rights and security duties whatever the tier. Art. 26(9) even has a deployer use the provider's instructions for its Art. 35 DPIA.
Do I need a DPIA for an AI system?
When the processing is likely to result in a high risk to people. Art. 35 names systematic and extensive evaluation, decisions with legal or similarly significant effects, and large-scale special-category data. Most AI systems that profile, score or rank people meet that threshold. The FRIA some deployers owe shares its parts with the DPIA, and Veritome fills one from the other.
Does Article 22 ban automated decisions?
It is a right, not a ban. A person has the right not to be subject to a decision based solely on automated processing with legal or similarly significant effects. Exceptions: the decision is necessary for a contract, authorised by law or based on explicit consent, and then only with safeguards such as human intervention and the right to contest.
What lawful basis covers training a model on personal data?
One of the six in Art. 6. Most often legitimate interests, which needs a documented balancing test, or consent, which must be as easy to withdraw as to give. Special-category data needs an additional Art. 9 condition. Veritome's lawful-basis step records the basis and reasoning per purpose; it does not decide the basis for you.
Is there a GDPR certificate?
No certificate is required, and none makes you compliant. Art. 42 allows voluntary schemes approved by supervisory authorities, and a few exist. Veritome is not a certifier and never issues one; the duties produce the records an authority or a customer would ask to see.
Does the GDPR apply to a company outside the EU?
Yes, when it offers goods or services to people in the EU or monitors their behaviour there (Art. 3(2)). Such a controller or processor usually has to designate an EU representative under Art. 27, one of the conditional organisation duties.
How does Veritome run the GDPR?
In two parts. The per-system duties are law: each AI system that processes personal data carries them beside its EU AI Act obligations, never gate-locked and never a switch. The organisation programme is optional and free on every plan: 19 duties in 4 groups plus Conditional / specialist, closing 61 article-level references. 3 open only when the condition holds on your register.
The other four