Keep policies, guidelines and regulations central and continuously current. Record and maintain technical and organizational measures (TOMs) in accordance with Art. 32 GDPR in a structured manner and link them to processing activities and contracts – an ongoing, auditable process rather than one-off documentation.
Policies
Manage all policies, guidelines, regulations and procedural instructions centrally in preeco | data protection – as a living process rather than filed-away documents. Keep data protection policies, IT security policies, deletion policies or access regulations structured and current, with regular reviews and a seamless version history. This way your policies stay effective, findable and demonstrable at any time. Just like the TOMs, policies can optionally be supplemented and revised with AI support.
TOMs
Document TOMs systematically by categories such as access control, authentication control, authorization control, transfer control, input control and encryption. AI-assisted content completion helps you formulate measures. Upload your existing TOM documents and continue managing them in a structured way in the system. Link TOMs to the processing activities they apply to – always audit-ready.
Features
From structured recording through versioning to export – all the tools for professional policy and TOM management.
Link TOMs to processing activities. The system automatically shows which measures are implemented for which processing operations.
All policies and TOMs in filterable overviews. Status, responsible persons, last update and links at a glance.
Upon approval, an immutable revision (PDF/ZIP or HTML) is created automatically. Two revisions can be compared visually – additions in green, removals in red – and verified for integrity via stored SHA-256 checksums. Seamless revision history for accountability obligations under Art. 5(2) GDPR.
Activity log, file attachments, tasks, comments, checklists and tags. The observer function automatically notifies relevant persons.
Export as PDF or DOCX. Linked documents for cross-tenant standardization.
FAQ
The structured form organizes TOMs into categories such as physical access control, system access control, data access control, transfer control, input control and encryption. Alternatively you can use your own categories if your organization already follows a different structure. Each measure is documented as a separate document with status and owner, so individual measures can be updated in a targeted way.
You upload existing documents and store them on the relevant measure. From there you continue the content in a structured way in the system, step by step rather than in one big migration. Optionally, the AI completes and revises the content; you review the suggestions and decide what to keep. This turns a collection of files into maintained, linked documentation.
You link each measure to the processing activities and contracts it applies to. Processing activities can also take over safeguards from linked data processing systems. For every processing operation you therefore see which measures are in place. The AI suggestions in the data protection impact assessment also take the linked TOMs into account.
All the guidelines, policies and procedures of your organization, for example data protection policies, IT security policies, deletion policies or access rules. Follow-up reminders schedule regular reviews, watchers are informed about changes, and tasks, comments and checklists keep the coordination within your team on the document. Like TOMs, policies can optionally be completed and revised with AI.
Every approval of a TOM automatically creates an immutable revision. You compare two revisions visually, with additions in green and removals in red, and stored SHA-256 checksums show whether a revision has been altered afterwards. The activities tab also shows who carried out which action and when. This supports your accountability under Art. 5(2) GDPR.
You export TOMs and policies as PDF or DOCX, formatted according to your document settings with logo, font, header and footer. Overview tables are exported as XLSX. Because the measures are linked to processing activities and contracts, you can also show which processing operations and contracts a measure applies to.
We will show you how preeco | data protection manages your policies and TOMs in a structured way.