Compliance and GDPR: an up-to-date record, requests handled on time and evidence ready, with analysis staying with the DPO.
The compliance officer and the DPO keep the record of processing, answer requests from individuals, assess new projects and monitor the anti-corruption programme. Their difficulty lies less in the rules than in the information: it sits in other departments’ tools, and has to be requested, copied and chased. Automation fetches it where it lives; analysis and judgement stay with compliance.
The role
Between executive management, IT, the business and the authorities.
Compliance makes sure the company meets its obligations and can prove it: personal data protection, corruption prevention, rules specific to its sector. It advises projects before launch, checks afterwards and documents what was done. In a mid-sized company, the role is often held by one person, sometimes with an external DPO, who depends entirely on departments’ cooperation.
Day to day
A typical day.
- MorningHandle data subject requests received: access, rectification, erasure, objection.
- MorningChase departments to collect a person’s data from the CRM, the HRIS or the e-commerce platform.
- MiddayAnswer a project manager launching a new tool: is a DPIA needed, which notices, which contract with the provider?
- AfternoonUpdate the record of processing after a change of tool or provider.
- AfternoonAssess a new supplier or intermediary under the anti-corruption programme.
- End of dayFollow action plans, mandatory training and the points to present to management.
The objectives
What the role is measured on.
- Data subject requests handled within the legal deadline
- Record of processing up to date
- Projects assessed before launch
- Processors covered by a compliant contract
- Third parties assessed before engagement
- Action plans closed
Indicators are named, never quantified: levels depend on each company, and the diagnostic measures them.
Day to day
The problems that come up most.
A record always behind
Tools change, providers too, and the record of processing is only updated when someone thinks of it, often before an audit.
Data scattered across tools
Answering an access request means querying the CRM, e-commerce, the HRIS, the mailbox and shared files, department by department.
Projects discovered after the fact
A new tool is already live when compliance hears about it; the DPIA and the processing agreement arrive late.
Processors poorly known
Who processes which data, where, with what safeguards: the real list of providers differs from the one in the record.
Third-party assessments by hand
Questionnaires sent by e-mail, searches done one by one, results in a spreadsheet: assessment struggles to keep pace with procurement.
Scattered evidence
Training, controls, assessments, decisions: everything was done, but gathering the documentation for an inspection takes time.
By sector
One role, several realities.
- Fashion and luxury
High-net-worth client data to protect with care, client files shared between boutiques in several countries, transfers outside the European Union and intermediaries to assess in high-risk markets.
- Retail
Loyalty programmes, in-store CCTV, online customer data, many delivery, payment and marketing providers to frame as processors.
- Cosmetics and beauty
Customer and loyalty programme data, skin diagnostics and apps, influencers and agencies, distributors to assess in several countries.
- B2B distribution and wholesale
Business customer files, vehicle geolocation, many suppliers and sales intermediaries to assess, gifts and hospitality to frame in commercial relationships.
- Construction and property
Chains of subcontractors to assess, data on employees and temporary staff on sites, access control, public contracts with integrity requirements.
- Industry
Export sales agents and distributors, employee data and site access badges, technical partners to assess, export controls to coordinate.
- Pharma and healthcare
Health and pharmacovigilance data, links with healthcare professionals to declare, trials and studies under specific rules, frequent inspections.
What changes
Automate the task, keep the judgement.
What gets automated
- A record of processing fed by the inventory of tools and providers, with an alert for every new tool or new contract.
- Data subject requests orchestrated across departments, with data collected from each tool and the legal deadline tracked.
- A project pre-assessment questionnaire that tells the DPO whether a DPIA appears necessary, with a first draft written by AI.
- Third-party assessment triggered from the procurement tool, with automatic searches and a due diligence questionnaire.
- Compliance evidence filed as work happens, ready for an audit or an inspection.
What stays human
- Compliance analysis, risk assessment and the opinions given to projects.
- The decision on a sensitive data subject request, a data breach or a high-risk third party.
- The relationship with the authorities and reporting to executive management.
Use cases
How to automate, case by case.
Each case starts from a question leadership teams ask. The starting point, what gets automated, the tools involved, and what stays in the teams’ hands.
How do you automate the GDPR record of processing activities?
- Today
- The record is a spreadsheet filled in during a compliance project, then updated in fits and starts. New tools, changes of provider and new purposes only go in if someone thinks of telling the DPO.
- What gets automated
- The record is linked to IT’s application inventory and to provider contracts: a new tool or a new contract creates a processing record to complete. An AI agent pre-fills the record from the project documentation: purpose, data categories, data subjects, recipients, proposed retention period. The DPO completes, corrects and approves.
- What stays human
- The DPO approves each record, the legal basis chosen and the retention period.
- compliance tool
- application inventory
- contract repository
- AI drafting agent
How do you automate GDPR data subject requests?
- Today
- Requests for access, rectification or erasure arrive by e-mail, through customer service or by post. The DPO writes to each department to gather the data, chases, compiles, and watches the response deadline in a diary.
- What gets automated
- Each request is logged on receipt, with its due date and verification of the requester’s identity. The tool sends search tasks to the departments concerned or queries the CRM, e-commerce and the HRIS directly, then gathers the results. An AI agent classifies the request, prepares the reply from templates and flags third-party data to redact.
- What stays human
- The DPO decides on the reply, particularly when an exception applies or the request is questionable.
- compliance tool
- CRM
- e-commerce platform
- HRIS
- AI classification agent
How do you automate erasing personal data across all tools?
- Today
- When a person asks for erasure, their data has to be deleted or anonymised in several tools that communicate poorly. Each department does it its own way, without proof, and copies survive in exports or shared files.
- What gets automated
- The approved request triggers an erasure task in each tool concerned, through a connector where possible, otherwise as a task assigned to the department. Retention obligations are checked before deletion, for invoices for example. Every action is logged and the evidence file builds up automatically.
- What stays human
- The DPO weighs erasure against legal retention obligations, and closes the request.
- compliance tool
- CRM
- ERP
- e-commerce platform
- workflow tool
How do you automate data protection impact assessments (DPIA)?
- Today
- The impact assessment is done on a blank document or a template, often after the project has launched. The DPO chases the project manager and the provider for technical information, and the assessment drags on.
- What gets automated
- A pre-assessment questionnaire, built into the launch of every project, shows whether a DPIA appears necessary. If so, the tool opens the file, collects answers from the project manager, IT and the provider, and an AI agent drafts a first description of the processing and the risks identified. The measures adopted are tracked until they are implemented.
- What stays human
- The DPO assesses the risks and gives an opinion; the controller decides whether to launch or adapt the project.
- compliance tool
- online questionnaires
- AI drafting agent
- project management tool
How do you automate tracking GDPR processors?
- Today
- Providers that process personal data are many: hosting, marketing tools, payroll, logistics. Their processing agreement, location and safeguards are checked case by case, when the DPO hears about them.
- What gets automated
- Creating a provider in the procurement tool triggers a simple question: does it process personal data? If so, the tool requests the processing agreement and the security safeguards, and an AI agent checks that the expected clauses are present. The list of processors and data locations feeds the record.
- What stays human
- The DPO judges whether the safeguards are sufficient, particularly for transfers outside the European Union.
- procurement tool
- contract repository
- AI document reading agent
- compliance tool
How do you automate managing personal data breaches?
- Today
- An e-mail sent to the wrong recipient, a lost laptop, unauthorised access: the incident is reported late, informally. The DPO rebuilds the facts in a hurry to decide whether to notify the authority within the legal deadline.
- What gets automated
- A reporting form, open to everyone, logs the incident with the time of discovery and starts the legal deadline countdown. The tool asks IT and departments for the relevant information: data affected, people concerned, measures taken. The breach register keeps itself, and a draft notification is prepared from the answers.
- What stays human
- The DPO and management decide whether to notify the authority and inform the people concerned.
- online form
- compliance tool
- incident management tool
- messaging
How do you automate applying data retention periods?
- Today
- The record sets retention periods, but nobody applies them: former customers, unsuccessful candidates and inactive prospects stay in the tools indefinitely.
- What gets automated
- The periods in the record are turned into rules in each tool: CRM, e-commerce, HRIS, recruitment tool. Data that has reached its term is flagged, archived or anonymised according to the rule, with a periodic report of what was processed. Exceptions, such as an ongoing dispute, block the purge.
- What stays human
- The DPO sets the periods and the exceptions; departments approve purges affecting their data.
- CRM
- HRIS
- e-commerce platform
- compliance tool
How do you automate third-party due diligence under Sapin II?
- Today
- Suppliers, distributors, agents and intermediaries must be assessed according to their level of risk. Compliance sends questionnaires by e-mail, searches one by one and records the results in a spreadsheet, often after the relationship has started.
- What gets automated
- The assessment is triggered as soon as the third party is created in the ERP or the procurement tool, with a level of diligence set by the risk map: country, type of third party, nature of the service. Searches on sanctions lists and in the press run automatically, and the questionnaire goes to the third party. An AI agent summarises the results and flags points of concern.
- What stays human
- Compliance decides whether to accept, refuse or frame the relationship with a flagged third party.
- procurement tool
- ERP
- compliance tool
- AI summarisation agent
How do you automate the register of gifts, hospitality and conflicts of interest?
- Today
- Employees declare gifts and hospitality received or offered by e-mail, when they remember. Conflict of interest declarations are collected on paper once a year and rarely reread.
- What gets automated
- A simple form lets employees declare a gift, hospitality or an interest, with the applicable rules shown at the time of entry. Declarations above the thresholds set by the code of conduct go to the manager and compliance for an opinion. The annual declaration campaign is relaunched automatically to the populations concerned.
- What stays human
- Compliance assesses each situation reported and decides on the measures to take.
- online form
- compliance tool
- HRIS
- messaging
How do you automate regulatory monitoring?
- Today
- Compliance follows official publications, law firm newsletters and authority guidance, each in its own inbox. Knowing which text concerns the company and who must act depends on the time available.
- What gets automated
- The sources followed are grouped into a single feed. An AI agent summarises each development, links it to the company’s themes and activities, and suggests the departments concerned. Compliance approves the analysis, then the tool creates the actions to carry out and tracks their completion.
- What stays human
- Compliance interprets the text, decides whether it applies and sets the actions to take.
- monitoring tool
- AI summarisation agent
- compliance tool
- messaging
Questions from the teams
What teams look to improve.
- How do you automate GDPR compliance in a mid-sized company?
- By linking compliance to the tools where data lives: application inventory, procurement, contracts, HRIS, CRM. The record of processing then stays up to date from these sources, data subject requests flow between departments without manual chasing and evidence builds up as work happens. The DPO keeps the analysis and the decisions.
- Can AI replace the DPO?
- No. It prepares: it drafts a first processing record or DPIA, classifies incoming requests, spots personal data in a document. Analysis, the opinion and accountability stay with the DPO and the controller.
- How do you keep the GDPR record up to date when tools change?
- By starting from IT’s application inventory and the list of provider contracts: every new tool or provider triggers the creation or update of a pre-filled processing record, which the DPO completes and approves.
- How do you meet the deadline for answering access requests?
- By logging each request on receipt with its due date, then automatically sending collection tasks to the departments concerned, with reminders. The DPO sees open requests and their due dates at any time.
- How do you know whether a project needs a DPIA?
- A short questionnaire, completed by the project manager, covers the criteria that make the assessment necessary: sensitive data, monitoring, profiling, large scale, new technologies. The result guides the DPO, who decides.
- How do you match third-party due diligence to the level of risk?
- By triggering it as soon as a supplier or intermediary is created, with a level of diligence set by the risk map. Searches and the questionnaire run automatically; compliance decides on the third parties flagged.
- Are the automation tools themselves GDPR compliant?
- They must be, and they must appear in the record: hosting chosen with IT, role-based access, set retention periods and a processing agreement with each provider.
- Where do you start when compliance rests on one person?
- With what recurs most and commits the company most: the data subject request workflow and updating the record from the tool inventory. These are the two subjects an inspection looks at first.
02 — Getting started
Describe what’s holding your teams back.
A first conversation to qualify your need. Then a scoped diagnostic: the scope, the solution, the estimate.
Discuss your projectReply within 48 business hours.