GDPR – Control Mapping
Diese Seite zeigt für GDPR, welche Wombat Controls welche Anforderungen dieses Rahmenwerks abdecken.
| Framework-Control | Anforderung | Wombat Controls | Schweregrad | Säule | Kategorie |
|---|---|---|---|---|---|
Art. 5(1)(a) – Lawfulness, fairness and transparency |
Art. 5(1)(a) – Lawfulness, fairness and transparency |
🟠 |
Sovereign Cloud |
identity-access |
|
Art. 5(1)(c) – Data minimisation |
Art. 5(1)(c) – Data minimisation |
🟠 |
Security |
identity-access |
|
Art. 5(1)(e) – Storage limitation |
Art. 5(1)(e) – Storage limitation |
🟠 |
Sovereign Cloud |
logging-monitoring, network-security |
|
Art. 5(1)(e) – Storage limitation (data not kept longer than necessary) |
Art. 5(1)(e) – Storage limitation (data not kept longer than necessary) |
🟠 |
Cost Optimization |
identity-access |
|
Art. 5(1)(e) – Storage limitation (logs containing personal data must not be kept indefinitely) |
Art. 5(1)(e) – Storage limitation (logs containing personal data must not be kept indefinitely) |
🟡 |
Cost Optimization |
logging-monitoring |
|
Art. 5(1)(f) – Integrity and confidentiality |
Art. 5(1)(f) – Integrity and confidentiality |
WAF-AGN-010 · WAF-AGN-020 · WAF-AGN-030 · WAF-AGN-050 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-080 · WAF-AGN-090 · WAF-AGN-100 · WAF-SEC-010 · WAF-SEC-020 · WAF-SEC-130 · WAF-SOV-060 |
🔴 🟠 🟡 🟢 |
Agentic, Security, Sovereign Cloud |
agentic-governance, identity-access, logging-monitoring, reliability-design |
Art. 9 – Special categories of personal data |
Art. 9 – Special categories of personal data |
🟠 |
Security |
identity-access |
|
Art. 17 – Right to erasure (cryptographic erasure via key deletion) |
Art. 17 – Right to erasure (cryptographic erasure via key deletion) |
🔴 |
Sovereign Cloud |
encryption-key-management |
|
Art. 17 – Right to erasure (lifecycle policies support GDPR deletion requirements) |
Art. 17 – Right to erasure (lifecycle policies support GDPR deletion requirements) |
🟠 |
Cost Optimization |
identity-access |
|
Art. 17 – Right to erasure (must be able to delete data) |
Art. 17 – Right to erasure (must be able to delete data) |
🟡 |
Sovereign Cloud |
logging-monitoring |
|
Art. 20 – Right to data portability |
Art. 20 – Right to data portability |
🟡 |
Sovereign Cloud |
logging-monitoring |
|
Art. 22 – Automated individual decision-making |
Art. 22 – Automated individual decision-making |
🟠 |
Agentic |
identity-access |
|
Art. 24 – Responsibility of the controller |
Art. 24 – Responsibility of the controller |
🟡 |
Security |
identity-access |
|
Art. 25 – Data protection by design |
Art. 25 – Data protection by design |
🔴 🟠 |
Agentic, Security |
identity-access, logging-monitoring |
|
Art. 25 – Data protection by design and by default |
Art. 25 – Data protection by design and by default |
🟠 |
Security |
identity-access |
|
Art. 28 – Processor |
Art. 28 – Processor |
🟠 🟡 |
Sovereign Cloud |
data-governance, logging-monitoring |
|
Art. 28 – Processor obligations |
Art. 28 – Processor obligations |
🟠 |
Security |
container-security |
|
Art. 28 – Processor obligations including data return/deletion on termination |
Art. 28 – Processor obligations including data return/deletion on termination |
🟡 |
Sovereign Cloud |
logging-monitoring |
|
Art. 30 – Records of processing activities |
Art. 30 – Records of processing activities |
🟠 🟡 |
Security, Sovereign Cloud |
identity-access, logging-monitoring |
|
Art. 32 – Security of processing |
Art. 32 – Security of processing |
WAF-AGN-010 · WAF-AGN-020 · WAF-AGN-030 · WAF-AGN-040 · WAF-AGN-050 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-080 · WAF-AGN-090 · WAF-AGN-100 · WAF-AGN-110 · WAF-REL-130 · WAF-SEC-010 · WAF-SEC-020 · WAF-SEC-040 · WAF-SEC-050 · WAF-SEC-060 · WAF-SEC-070 · WAF-SEC-080 · WAF-SEC-090 · WAF-SEC-110 · WAF-SEC-120 · WAF-SEC-130 · WAF-SEC-140 · WAF-SEC-150 · WAF-SEC-160 · WAF-SOV-070 · WAF-SOV-110 |
🔴 🟠 🟡 🟢 |
Agentic, Reliability, Security, Sovereign Cloud |
agentic-governance, backup-recovery, container-security, encryption-key-management, identity-access, logging-monitoring, network-security, reliability-design |
Art. 32 – Security of processing (access control) |
Art. 32 – Security of processing (access control) |
🔴 |
Sovereign Cloud |
identity-access |
|
Art. 32 – Security of processing (availability and resilience) |
Art. 32 – Security of processing (availability and resilience) |
🟠 |
Sovereign Cloud |
logging-monitoring |
|
Art. 32 – Security of processing (encryption) |
Art. 32 – Security of processing (encryption) |
🟠 |
Security |
identity-access |
|
Art. 32 – Security of processing (encryption as a technical measure) |
Art. 32 – Security of processing (encryption as a technical measure) |
🔴 |
Sovereign Cloud |
encryption-key-management |
|
Art. 32 – Security of processing (including integrity monitoring) |
Art. 32 – Security of processing (including integrity monitoring) |
🟠 |
Sovereign Cloud |
network-security |
|
Art. 32 – Security of processing (network security) |
Art. 32 – Security of processing (network security) |
🟠 |
Sovereign Cloud |
identity-access |
|
Art. 33 – Breach notification to supervisory authority |
Art. 33 – Breach notification to supervisory authority |
🟠 |
Security |
identity-access |
|
Art. 33 – Breach notification within 72 hours |
Art. 33 – Breach notification within 72 hours |
🟡 |
Security |
identity-access |
|
Art. 33 – Notification of personal data breach |
Art. 33 – Notification of personal data breach |
🟠 |
Sovereign Cloud |
identity-access |
|
Art. 33 – Personal data breach notification |
Art. 33 – Personal data breach notification |
🟠 |
Security |
logging-monitoring |
|
Art. 34 – Communication of breach to data subject |
Art. 34 – Communication of breach to data subject |
🟡 |
Security |
identity-access |
|
Art. 44 – General principle for transfers |
Art. 44 – General principle for transfers |
🔴 🟠 |
Sovereign Cloud |
identity-access |
|
Art. 44-46 – Transfers to third countries |
Art. 44-46 – Transfers to third countries |
🟠 🟡 |
Sovereign Cloud |
identity-access, logging-monitoring, network-security |
|
Art. 46 – Transfers subject to appropriate safeguards |
Art. 46 – Transfers subject to appropriate safeguards |
🟠 |
Sovereign Cloud |
identity-access |
|
Art. 46 – Transfers to third countries |
Art. 46 – Transfers to third countries |
🔴 |
Sovereign Cloud |
identity-access |
|
Art. 46 – Transfers with appropriate safeguards |
Art. 46 – Transfers with appropriate safeguards |
🟠 |
Sovereign Cloud |
data-governance |
|
Article 5(1)(e) – Storage limitation principle |
Article 5(1)(e) – Storage limitation principle |
🟡 |
Sustainability |
backup-recovery |
|
Article 5(1)(f) – Integrity and confidentiality |
Article 5(1)(f) – Integrity and confidentiality |
🔴 |
Reliability |
secret-management |
|
Article 25 – Data protection by design and by default |
Article 25 – Data protection by design and by default |
🟡 |
Sustainability |
backup-recovery |
|
Article 32 – Security of processing (data availability) |
Article 32 – Security of processing (data availability) |
🔴 |
Reliability |
secret-management |
|
Article 32 – Security of processing (resilience and recovery testing) |
Article 32 – Security of processing (resilience and recovery testing) |
🟠 |
Reliability |
backup-recovery |
|
Article 33 – Notification of a personal data breach to the supervisory authority |
Article 33 – Notification of a personal data breach to the supervisory authority |
🟠 |
Reliability |
logging-monitoring |