Purposes and bases
Every processing purpose named, with a lawful basis that is not a guess.
Resources · GDPR guide
Accountability is the work. A badge is not a lawful basis.
GDPR is enforced by supervisory authorities, not by a compliance product. ReadyComply holds purposes, records, rights, processors, and transfers. It does not decide you are adequate.
The distinction
A privacy policy is not a RoPA.
Article 30 records are a living inventory of processing. A marketing page that says “we care about privacy” is not that inventory. Version the notice. Keep the RoPA in evidence with a date.
The work
What readiness actually is.
Rights you can fulfil
Access, erasure, portability, and the rest need an owner and an SLA, not a mailto link.
Processors and transfers
DPAs and a transfer mechanism. Subprocessors should match the list you publish.
Security that agrees
Article 32 should not contradict your SOC 2 or ISO technical story.
Where ReadyComply stops
It does not decide you are adequate.
There is no compliance score for an article in the product. Status is a human field. Connectors, when they exist, attach evidence to a record or a processing entry. They do not rule on lawful basis, and they do not stand in for your DPO, your counsel, or a supervisory authority. If a page on this site sounds like a certification, it is wrong.
Framework
The GDPR product page.
Workspace
The four records.
Controls
Scope SOC 2, ISO 27001, HIPAA, and GDPR families to each system. Track status, owner, and why something is out of scope.
Evidence
File what you have against a control. Manual upload or a read-only connector.
Policies
Versioned drafts next to the controls they support. Know which text is current.
Checklist
Run it in order.
Open the workspace. Keep the register current.
Sign in. Create the first system. Start with what you can already prove.
Sign in