How it works today: GDPR compliance as a folder structure
In many companies, the shared drive holds a folder "Data Protection" with subfolders such as "01_Records", "02_TOMs", "03_Deletion", "04_DPIA" and "05_Breaches". Each folder was created at a different time: the records after the GDPR took effect, the TOMs for the first customer request, the deletion concept after a note from the external data protection officer, the impact assessment when the new applicant tracking system went live.
Each of these documents is tidy on its own. The problem lies between them. The deletion concept names data categories that are named differently in the records. The TOMs describe the company as a whole, but not which measure applies to which processing. The impact assessment refers to a version of the records that has since been revised twice.
An access request under Art. 15 GDPR arrives at "info@" and is forwarded to HR with the line "Can you check what we have stored about this person?". A lost laptop is reported by phone on Friday afternoon, and on Monday someone asks whether it has to be reported. Deletion happens when someone remembers – none of it is documented.
Smaller organizations and associations look similar: one folder instead of five, a volunteer or part-time role, and often the belief that records are only required above a certain size. That is usually not the case. The exemption in Art. 30(5) GDPR for organizations with fewer than 250 employees does not apply once processing is more than occasional – and payroll or membership administration is regular.
Eventually the documentation is moved into software. Often only the records move; the other folders stay put. The tool is new, but the structure is the same: separate documents with no link between them.
The moment it becomes obvious
It shows when several documents are needed at once. A customer's vendor review questionnaire asks: Which processing activities involve our data, which measures protect it, when is it deleted, and how does your data breach process work? Or the supervisory authority asks about a specific incident, and you have to show when the company became aware of it.
Both cases start a search through five folders. The answers exist, but they do not fit together: the records name a system that is missing from the deletion concept, the TOMs are two years old, and the reporting route is a note on the intranet. Now it becomes clear that GDPR compliance for companies is not a set of separate documents but a connected process.
The analysis
Five gaps between the documents
They do not come from a lack of care but from each document having been created on its own, without knowing about the others.
View processing activities in preecoThe records are not the starting point
The deletion concept and the impact assessment refer to processing activities that are named differently in the records or missing from them. When someone asks about a specific processing activity, the answers do not fit together.
Retention periods sit in the concept, not in the workflow
The deletion concept sets periods, but nobody is reminded when a deletion is due. Whether data was actually deleted cannot be proven later.
TOMs that apply to everything and nothing
A general document on technical and organizational measures does not say which measure protects which processing. When a system changes, it remains unclear which details are affected.
The reporting route exists only on paper
Without a fixed intake for data breaches, a report often reaches the responsible person only after days. That leaves little time for the assessment within 72 hours under Art. 33 GDPR.
No version can be proven
Art. 5(2) GDPR requires you to be able to demonstrate compliance with the principles. Files without approval and version history show only the latest state, not who was responsible for it and when.
The target process in six steps
The order matters: every document builds on the records of processing activities.
1. Start with the records as the foundation. In preeco | data protection you upload existing records as DOCX or XLSX; optionally, AI detects the processing activities they contain. If there are none yet, AI derives suitable processing activities from an organization and a free description of its tasks. Either way, you review a preview and adopt the entries as drafts.
2. Record systems and TOMs once. Each data processing system is created once, and technical and organizational measures under Art. 32 GDPR are documented in categories such as access control or transfer control. Linked to the processing activities, the system shows which measures are in place for which processing.
3. Derive the deletion concept from the records. Deletion classes refer to processing activities and adopt many details from them. Deletion rules describe the actual deletion procedure; retention periods take statutory retention duties into account, for example under HGB and AO. Tasks on deletion rules trigger manual deletions or check automatic ones, and their log proves execution.
4. Connect data subject rights to the records. Requests arrive through a web form on your website as a case, and the one-month deadline under Art. 12(3) GDPR is monitored. Link an access request to the affected processing activities and the system shows the related data processing systems and data fields – the records become the map for your answer under Art. 15 GDPR.
5. Assess risks before new processing. The threshold analysis in the processing activity helps check whether a data protection impact assessment (DPIA) under Art. 35 GDPR is required. The DPIA adopts details from the linked processing activities; on request, AI suggests a risk catalog and countermeasures. You record the result as a status: Acceptable, Act/Review or Unacceptable.
6. Prepare the reporting process before you need it. Breach reports arrive through a form on your website or intranet. The system monitors the 72-hour deadline under Art. 33 GDPR and shows for each report whether the deadline is still running and whether it was reported on time or late. Nine included report templates cover the notification to the supervisory authority and the communication to data subjects under Art. 34 GDPR.
How to recognize suitable data protection software
Three qualities matter day to day. Ease of use: part-time data protection staff must manage without lengthy training. Audit readiness: every approval should create an unchangeable version; in preeco | data protection a revision is created automatically, and the activity log records who changed what and when. Scalability: several organizations can be managed in one team, so an external data protection officer can look after several clients. More questions to check: Choosing GDPR software for SMEs.
Before and after at a glance
| Criterion | Before | After |
|---|---|---|
| Maintenance effort | Each document separately, details entered repeatedly | Entered once, adopted through links |
| Currency | Differs from folder to folder | Reminders prompt each review |
| Completeness | Gaps go unnoticed | Links visible per document |
| Evidence | Latest file, version in file name | Revision per approval, activity log |
| Deadlines | One month and 72 hours from memory | Monitored deadlines, status per report |
| Deletion | Concept, no proof of execution | Task log of deletion rules |
| Collaboration | Forwarded emails, file copies | Tasks, comments, data collection forms |
| Key-person risk | Knowledge with one person | Process and history in the system |
In practice
This Is What It Looks Like in preeco | data protection
The three building blocks the workflow described here rests on.
Processing activities and systems
Import of existing records as DOCX or XLSX, AI suggestions for individual sections including the threshold analysis, and central system management as the basis for every further document.
Deletion concept
Deletion classes linked to processing activities, deletion rules with tasks, review reminders for due checks, and an export with the task log as proof of execution.
Requests and incidents
Data subject requests and data breaches with monitored deadlines, web forms, a clear reporting deadline status and nine included report templates.
What the switch means in practice
Starting with the records gives every next step its basis: deletion classes, impact assessments and incidents refer to processing activities that already exist. The gaps that surface – a processing activity without a retention period, a system without measures – are not a setback but exactly the work that went unnoticed before. Each step has its own practice guide: records of processing, deletion concept, data subject requests, risk analysis and DPIA and data breaches.
A cloud environment of preeco | data protection is ready within 48 hours on business days. Onboarding covers setting up the organizational structure, user groups and permissions, plus online training for administrators and users. The content takes longer: who is responsible for which processing, and who approves documents?
Three mistakes that make the setup harder
Starting with the most urgent document. If you digitize the reporting process first after a data breach, there are no processing activities to link the incident to. Records first; everything else builds on them.
Keeping the old folders running in parallel. As long as the deletion concept is also maintained as a Word file, there are two versions, and the wrong one wins. Decide from when the system is the only source.
Only describing the reporting route. A policy on the intranet does not replace a reporting form. If employees do not know where to report a lost laptop, time passes that is missing for the assessment within 72 hours.
How to tell it is time
A folder structure is not a mistake at the start. It becomes a risk once at least one of these applies:
- Deletion concept and records name different data categories.
- You cannot prove that deletions were actually carried out.
- Nobody knows who takes breach reports at weekends.
- Impact assessments refer to an outdated version of the records.
- Customers ask for your documentation in vendor reviews.
If none applies, your current structure is fine. If more than one applies, it already costs more time than it saves.
FAQ
Frequently asked questions on digital GDPR compliance
Software that records data breaches in a structured way, links them to the affected processing activities and monitors the 72-hour deadline under Art. 33 GDPR. In preeco | data protection each report shows whether the deadline is still running and whether it was reported on time or late. Nine included report templates cover the notification to the supervisory authority, the communication to data subjects under Art. 34 GDPR and reports to the BSI.
As a rule, yes. Art. 30(5) GDPR exempts organizations with fewer than 250 employees only if the processing is occasional, is not likely to result in a risk to the rights and freedoms of data subjects and includes neither special categories of personal data nor data relating to criminal convictions. Payroll or membership administration takes place regularly, so records are almost always required.
You derive it from the records. In preeco | data protection deletion classes refer to processing activities and adopt many details from them. Deletion rules describe the actual deletion procedure, and retention periods take statutory retention duties into account, for example under HGB and AO. Review reminders flag due checks, and the task log of the deletion rules is included in the export as proof of execution.
A tool that maps the DPIA as a guided process under Art. 35 GDPR and adopts details from the records. In preeco | data protection the threshold analysis in the processing activity supports the preliminary check of whether a DPIA is required. On request, AI suggests a risk catalog and countermeasures; the assessment stays with your team. Every save into the statuses Acceptable, Act/Review or Unacceptable creates a revision.
Yes. preeco | data protection supports multiple clients: several organizations are managed in one team, an organization selector switches between them, and permissions determine who sees which organization. An external data protection officer can look after several clients this way, while departments contribute through data collection forms.
Go through your documentation together
Bring your records and your deletion concept. In 30 minutes we show how both connect in preeco | data protection and where the gaps are.