The remaining duties, one by one
For each duty: what the GDPR expects, how to tackle it pragmatically — and how Floriti keeps your back covered while you do.
Art. 5 (1) e, 17 Deletion concept & storage limitation
Data may live only as long as purpose or retention law requires — after that it must actually go.
How to tackle it
- Set a retention period per processing entry (statutory examples in Germany: 6/10 years commercial/tax law; applicant data: 6 months after rejection).
- Build deletion classes instead of juggling individual deadlines (DIN 66398 approach): few classes, clear triggers.
- Establish a fixed "deletion day" per quarter or year: owners work through the due classes in the source systems and log it.
- Do not forget paper files — and backups: there it suffices that deletion follows the rotation cycle (document it!).
Floriti leverage: retention as a required field in the processing record, a "deletion log" register as proof of execution, reminders as the deletion-day alarm. And register data inside Floriti you delete right there — with an audit-log entry.
Art. 7, 8 Obtaining, proving and revoking consent
Wherever you rely on consent, you must be able to prove it — and withdrawing must be as easy as giving it.
How to tackle it
- Website: a consent banner with a real choice (no "accept-only" design), decisions logged.
- Newsletters & forms: double opt-in, an unsubscribe link in every mail.
- Offline consent (event photos, reference naming): collect in writing and file centrally.
- Careful with employees: because of the power imbalance, consent is rarely the right legal basis there — check whether Art. 6 (1) b/f carries instead.
Floriti leverage: a "consents" register for all offline cases (who, for what, when, scan attached, withdrawal date) with a report "active consents per purpose". Your consent tool handles the website part; Floriti documents which tool runs with which configuration.
Art. 9, 10 Special categories (health, religion, …)
Sensitive data is prohibited by default, with narrow exceptions — every such processing needs a verified exception under Art. 9 (2).
How to tackle it
- Inventory first: where does sensitive data occur at all? (HR: sick notes, disability status, religious affiliation for payroll tax — almost every company has some.)
- Name the exception per occurrence (usually Art. 9 (2) b — employment-law duties) and apply stricter measures: narrower access, encryption where feasible.
- When in doubt, get legal advice — fines are highest here.
Floriti leverage: a "special categories? (yes/no)" field in the processing record — a condition then automatically reveals the follow-up questions (exception used, extra measures). The business department cannot skip them.
Art. 12–14 Information duties: privacy notices
Data subjects must be informed clearly at the time of collection — on your website, towards employees and applicants, for video surveillance.
How to tackle it
- One notice per audience: website, customers, employees, applicants — not one catch-all text.
- Most of the content already lives in your processing record: purposes, legal bases, recipients, retention. Derive the texts from it instead of inventing them.
- Video surveillance: signage before entering the area, naming controller and purpose.
- Review once a year — and whenever a new processing activity is approved.
Floriti leverage: export the processing record as source material for your lawyer or generator; keep a "privacy notices" register with file attachments, versions and a yearly review reminder. A rule can automatically create a check task whenever a new processing entry is approved.
Art. 26, 27 Joint controllership & EU representative
Running joint processing with partners (a shared portal, a Facebook page) requires an Art. 26 agreement. Non-EU companies with EU business need an EU representative (Art. 27).
How to tackle it
- Check where you determine purposes and means jointly with others — it happens more often than expected (social media presences!).
- Agree a clear split of roles: who answers data subject requests, who informs?
- The essence of the agreement must be available to data subjects (privacy notice).
Floriti leverage: the agreements belong as entries in your partner/processor register — with responsibility fields, so in an incident it is instantly clear who delivers.
Art. 28 Actually signing the data processing agreements
Every service provider processing personal data on your behalf (hoster, newsletter tool, payroll office, IT support) needs a DPA — before processing starts.
How to tackle it
- Take stock via your accounts-payable list: every vendor with data access is a candidate.
- SaaS providers usually offer the DPA for online signature — sign it, archive the PDF.
- New tools only with a DPA check in onboarding: no contract, no rollout.
- Watch the providers' sub-processor lists (subscribe to change notifications).
Floriti leverage: your processor register keeps contract (attachment), signing date and review cycle per vendor; reminders enforce the yearly check, and the approval workflow puts a second pair of eyes on every new entry.
Art. 29, 32 (4) Committing and training your staff
Everyone with access to personal data may act only on instruction and must be bound to confidentiality and trained.
How to tackle it
- Confidentiality commitment as part of onboarding: signed on day one, copy in the personnel file.
- A yearly short training (45–60 min is enough): phishing, handling requests, clean desk, breach reporting path. External e-learning saves effort.
- Train new joiners within their first 4 weeks, not at the next annual date.
Floriti leverage: a "training & commitments" register (person, date, content, proof attached) with a 12-month reminder; rule automation can turn stragglers into real work orders — completion shows up on the admin's task tile.
Art. 32 Actually implementing the TOMs (IT security)
The documented technical and organisational measures must really exist — documentation without implementation backfires in every audit.
The practical minimum
- Access: two-factor authentication wherever possible; individual accounts instead of shared logins; rights on a need-to-know basis; an offboarding checklist (accounts blocked on the last day).
- Devices & systems: full-disk encryption, automatic updates, central antivirus, screen lock.
- Data: daily backups with a tested restore, TLS in transit, encrypted e-mail for sensitive content.
- Organisation: an emergency plan (who does what when something fails), key/access rules, paper handling (shredder, not wastebasket).
- For maturity guidance: BSI IT-Grundschutz profiles for SMEs or CIS Controls IG1; more ambitious: ISO 27001.
Floriti leverage: every measure as an entry in the TOM register with status, owner and review reminder — turning declarations into a control loop. For the data inside Floriti itself we already ship 2FA, SSO, a role concept, daily backups and EU hosting.
Art. 33 Rehearse the emergency once
The 72-hour window for notifying the supervisory authority is short — it only works if the path is clear beforehand.
How to tackle it
- Make the internal reporting path known: every employee must know where to report an incident immediately (and that reporting is never punished).
- Look at your authority's online notification form once and know the required details.
- Run a 30-minute dry exercise once a year: fictitious incident, walk the process, note the gaps.
Floriti leverage: the intake channel is built in minutes with Floriti's public forms — every report automatically becomes an entry in your incident register. The follow-up runs on workflow steps, with several departments collaborating on the same case and every deadline in view; the demo workspace has this set up ready to explore. Only sending the notification to the authority is still on you — the workflow hands you the complete chronology at the press of a button. The drill itself, and its protocol, belong in the training register.
Art. 37 Appointing and registering a data protection officer
Whether you need a DPO depends on your activities (in Germany additionally: usually from 20 people with permanent automated processing). If yes: appoint formally and register with the supervisory authority.
How to tackle it
- Check the obligation — when unsure, a voluntary external DPO is often cheaper than the uncertainty.
- External vs. internal: external (typically 200–600 €/month for SMEs) avoids conflicts of interest and dismissal-protection issues; internal requires proven expertise and ongoing education.
- Register the DPO's contact via the authority's online portal and add it to your privacy notice.
Floriti leverage: involve the DPO as an approver with their own scope and send them reports by e-mail subscription — "early involvement" (Art. 38) becomes daily routine instead of a claim.
Art. 44–49 Securing third-country transfers
Data may leave the EU only with safeguards — an adequacy decision, or standard contractual clauses (SCC) plus a transfer impact assessment (TIA).
How to tackle it
- Transfers almost always hide among your vendors: US cloud, support teams outside the EU, the parent group. The DPA stock-take uncovers them.
- Check in this order: adequacy decision (e.g. EU-US Data Privacy Framework — is the provider certified?) → otherwise SCC + a short TIA → otherwise switch providers.
- Prefer EU alternatives when selecting tools — it spares you the whole assessment cascade.
Floriti leverage: a "third-country transfer?" field in the processing/processor register; a condition then reveals the safeguard questions (DPF? SCC? TIA date?). Floriti itself is hosted in the EU, and for the AI features you can plug in an EU or on-premise endpoint.