CGPulse

Sign In

GDPR: Data Protection Controls

Azure 40 automated checks

Technical controls supporting GDPR compliance for cloud resources, focusing on data protection, encryption, and access control

Access Control (Art. 25)

Accountability (Art. 30)

IAM password policy must require minimum length of 14 Art.30 · Medium

Awareness

Organization should provide GDPR awareness training to all staff Art.39 · Medium

Breach Notification

Organization should have breach notification procedures Art.33-34 · Critical

Breach Notification (Art. 33)

IAM password policy must require minimum length of 14 Art.33 · Medium

Consent

Organization should implement valid consent mechanisms Art.7 · High

Data Breach Notification

Organization should have a documented incident response plan Art.33 · High

Data Minimization (Art. 5)

Key Vault must enable purge protection High

Data Protection (Art. 32)

Data Protection Impact Assessment

Organization should conduct periodic risk assessments Art.35 · High

Data Protection Officer

Organization should appoint a Data Protection Officer where required Art.37 · High

Data Subject Rights

Organization should maintain a privacy policy Art.13 · Medium
Organization should have procedures to handle data subject access requests Art.15 · High
Organization should implement right to erasure procedures Art.17 · High
Organization should support data portability requests Art.20 · Medium

Encryption (Art. 32)

Governance (Art. 37)

IAM password policy must require minimum length of 14 Art.37 · Medium

Impact Assessment

Organization should conduct Data Protection Impact Assessments for high-risk processing Art.35 · High

International Transfers

Organization should have safeguards for international data transfers Art.44-49 · High

Lawful Processing

Organization should document lawful basis for all personal data processing Art.6 · Critical

Network Security (Art. 32)

Key Vault should disable public network access High

Privacy by Design

Organization should implement data protection by design and by default Art.25 · Medium

Processor Management

Organization should have data processing agreements with all processors Art.28 · Critical

Processor Management (Art. 28)

IAM password policy must require minimum length of 14 Art.28 · Medium

Processor Obligations

Organization should assess third-party vendor security Art.28 · Medium

Records of Processing

Organization should maintain a data classification policy Art.30 · Medium

Risk Assessment (Art. 35)

IAM password policy must require minimum length of 14 Art.35 · Medium

Storage Limitation

Organization should define and enforce data retention schedules Art.5(1)(e) · High

Transparency

Organization should provide transparent privacy notices Art.13-14 · High

Transparency (Art. 13/14)

IAM password policy must require minimum length of 14 Art.13 · Medium

Measure your GDPR: Data Protection Controls posture

CGPulse maps live Azure and AWS findings to these controls and tracks drift over time.

Start free scan

Official framework documentation