GDPR Example Evidence

The table below lists commonly evidenced control areas for General Data Protection Regulation (GDPR) and the artifacts that typically satisfy them; attach these to your controls as evidence.

Control Area	Example Evidence
Quarterly vulnerability scans	Scan results covering each of the last four quarters
Annual penetration testing	Report from the most recent annual penetration test
Privacy policy inclusions	The published privacy notice from your website showing the required disclosures
Privacy policy acceptance	Screenshots of the registration flow demonstrating that users must explicitly agree to the privacy notice before sign-up completes
Minimal information required	A completed record of processing activities (ROPA) documenting how each collected personally identifiable information (PII) field will be used
Annual review of processing purposes	Minutes from management's yearly review of privacy policies
Purposeful use only	The section of your privacy notice or policy stating that personal data is used only for its declared purposes
Tracking breaches of PII	Screenshots from the tracking system used to log breaches and security incidents involving personal data
Notice of breach to affected users	Documented breach notification procedures and the template used to notify affected individuals
Business continuity plan	Current business continuity plan
Vulnerability management	Current vulnerability management policy
Scope of privacy program	A document summarizing the scope of your privacy program, drawing on your ROPA
Designated data protection official	Documentation formally appointing a data protection officer (DPO)
Management of sensitive information	Data classification policy covering classification and handling of PII, plus security awareness materials that address PII handling and how to report issues
Data subject consent	Documentation of how consent is captured before processing; screenshots of consent mechanisms such as a checkbox on a registration form; records of consent kept in systems such as your CRM
Withdrawal of consent	Privacy notice language explaining how consent can be withdrawn; screenshots of opt-out mechanisms such as unsubscribe links in email footers; records of withdrawals and the follow-up actions taken
Notification of disclosures to third parties	Process documentation or templates for notifying stakeholders when PII is disclosed to third parties, plus records of those disclosures
International transfer of personal data	Privacy notice and data processing agreement (DPA) language describing how cross-border transfers are handled
Joint controllers	Privacy notice and DPA language defining each controller's roles and responsibilities where joint controllers are used
Communication of obligations to data subjects	Privacy notice describing your privacy obligations and the channels for making requests; records of data subject requests (DSRs) and their resolution; any response templates used
Organizational context	Documentation describing where your organization sits in the data processing ecosystem, for example as controller, processor, or subprocessor
Record of processing activities (ROPA)	Completed ROPA covering each population whose data you process, such as customers, prospects, website visitors, and employees
Data processing agreements	The DPA template used when sharing PII with third parties, and fully executed contracts that incorporate it
Data protection impact assessment (DPIA)	Completed DPIA documentation, prepared before processing begins; separate assessments per use case can help when processing is complex
Collection of special category PII	ROPA entries identifying whether special categories of PII are collected and which allowable conditions are relied on
Tracking and response to data subject requests	A log of DSRs received and the actions taken to resolve each one
Management of data subject rights	Privacy notice explaining how data subjects exercise their GDPR rights, such as a dedicated inbox or web form; the DSR log; internal runbooks used to fulfill requests such as deletion
Representative for non-EU controllers/processors	Documentation designating an EU representative, where one is required for your organization