Effivity GDPR guide: how the software holds your compliance programme and its evidence

Why a GDPR programme needs a system of record

A supervisory authority opening an enquiry and a client auditor working through due diligence ask the same thing: show me. Show the record of processing for this service, the lawful basis chosen and why, the processor agreement for the hosting provider, the request that came in last month and the date it was answered. Article 30(4) obliges controllers and processors to make the record available to the authority on request, and Article 33(5) requires every breach to be documented, including those never notified.

Most organisations hold these pieces somewhere: the inventory in one person's spreadsheet, contracts in a legal folder, requests in a shared mailbox, incidents in the IT ticketing tool. Nobody can follow one activity from end to end, and nobody notices when a piece goes out of date.

Effivity, Sterling's ISO and GRC software, used in 50+ countries, puts those pieces in one place with an owner, a review date and a history of changes. The Regulation requires no software; it requires demonstration, which is far easier when decisions and their records live together.

Effivity modules mapped to GDPR obligations

Effivity has no module called GDPR. Sterling configures its management system modules for the Regulation's obligations and, where no module fits, builds a workflow with a form, an owner and reminders. The articles themselves are covered in the requirements guide; the table shows where each obligation runs.

Dashboards and alerts show requests nearing their one-month deadline, overdue DPIAs, processors without a signed agreement and open breach actions.

Worked example: a misdirected payroll file

A payroll administrator sends a salary file for forty employees to the wrong external address and logs it in Incident Management within the hour, fixing the moment of awareness from which the 72-hour window runs. The privacy lead assesses the risk to the people concerned, records the recipient's written confirmation of deletion and decides with the DPO whether to notify the supervisory authority; either way the reasoning stays on the record. The root cause, an auto-completed e-mail address, becomes a Non-Conformance with a corrective action, and the payroll entry in the record of processing notes the new transmission control. A client auditor asking later how breaches are handled sees one dated trail, not a procedure alone.

What Sterling sets up in the first weeks

Effivity is configured as the gap analysis starts, so the programme is built where it will run.

• Roles decided before records are written. Whether you act as controller, processor or both for each activity, and whether Article 3(2) reaches you from outside the EU, shapes which obligations apply, so it is settled first.
• Data mapping with the teams that hold the data. HR, finance, sales, marketing, customer service and IT each describe their own activities in working sessions; the record of processing is then generated from that inventory, not typed separately.
• A processor register built from real supplier lists. Each supplier touching personal data is listed in Purchase, its agreement checked against Article 28(3) and any transfer outside the EU or EEA given its safeguard.
• Workflows for the work that recurs. Rights requests, DPIA screening, processor approval, retention reviews and breach handling each receive a form, an owner, a due date and escalation.
• Existing documents kept where they work. Notices, policies and contracts that match practice move into Documented Information; the rest are redrafted from Effivity's pre-built templates, adapted to your processing.

Once controls have left records, the internal audit runs in Internal Audit and findings close through Non-Conformance; GDPR internal audit: planning, conduct and reporting covers the audit itself.

Answering regulators, client auditors and questionnaires

Because no GDPR certificate exists, the test arrives in other forms: a customer questionnaire before signature, a client audit, or a complaint passed on by a supervisory authority.

With the programme in Effivity, most answers are a report rather than a project. The record of processing can be extracted for the activities a client cares about, the processor register shows which sub-processors handle their data, and the request log and breach register show timings.

If a certificate is wanted later, through ISO/IEC 27701 or an approved Article 42 scheme, the same records carry forward; GDPR vs ISO/IEC 27701, ISO/IEC 27001 and SOC 2 compares the routes. Where an ISO/IEC 27001 system already runs in Effivity, the programme shares its document control, audits, reviews and corrective action.

Keeping the programme current with Sustain™

A GDPR programme decays quietly: a new analytics tool, a support team in another country, a supplier's new sub-processor, none of it reaching the record.

Effivity counters this with review dates on every activity and processor, DPIA screening in project and procurement steps, and escalating reminders; the annual internal audit and management review test whether those triggers worked. Under Sustain™, Sterling continues with internal audits, DPIA support, regulatory watch, refresher learning and updates when a new law or an amendment applies, all in the same Effivity system.

Where Effivity stops

Effivity manages the programme; your customers' and employees' personal data is processed elsewhere. It does not collect consent, scan your systems for personal data or delete records from your applications. Those actions happen in your own technology, whose logs remain the primary proof, while Effivity holds the decision, the owner, the date and the confirmation. Choosing a lawful basis or interpreting national law remains with you and your legal advisers.

Three habits undo a good configuration:

• Treating the record of processing as a one-off deliverable. If entries carry no review date, the first client audit will find systems the record never mentions.
• Loading requesters' documents into request records. The log needs dates and decisions, not identity documents.
• Logging only the breaches that were notified. The register must also show incidents judged unlikely to cause a risk, with the reasoning.

Effivity for the GDPR: questions buyers ask