GDPR Compliance
You are responsible for your data — and for the data your subcontractors handle. Prove it.
DPA notification
Maximum penalties
Of global turnover
Key requirements
Assess your GDPR
Get a score out of 1,000 and personalized recommendations in 4 minutes.
Start the GDPR diagnosticThe GDPR has been in force since 2018. Yet most organizations still haven't structured their compliance in a demonstrable way. Processing records are incomplete, impact assessments are missing, breach notification procedures are untested — and above all, subcontractor oversight remains a major blind spot.
The GDPR is clear: the data controller is responsible for the data entrusted to its processors. Article 28 imposes a strict contractual framework (DPA), verification of technical and organizational safeguards, and regular monitoring. In the event of a data breach at a subcontractor, it is your organization that will be questioned.
Conitiv enables you to assess your own GDPR compliance, score your subcontractors' security posture, centralize evidence, and document your oversight — all through a proportionate and traceable approach.
What the GDPR specifically requires
Records of processing
Document each personal data processing activity, its purpose, legal basis, recipients, and retention periods.
Impact assessments (DPIA)
Mandatory for high-risk processing. Many organizations still neglect them.
Data subject rights
Right of access, rectification, erasure, portability. Your procedures must be operational, not theoretical.
Processing security
Technical and organizational measures proportionate to the risk. Encryption, access control, pseudonymization.
Breach notification
72 hours to notify the supervisory authority in case of a data breach. You need a process that actually works.
Subcontractor oversight
Formalized DPA, guarantee verification, security level assessment. It's your responsibility, not theirs.
The blind spot: your subcontractors
Article 28 of the GDPR requires data controllers to ensure that their processors provide sufficient guarantees. In practice, this means: a formalized DPA, a security posture assessment, regular monitoring, and the ability to demonstrate all of this in case of an audit.
to notify the supervisory authority
But reality tells a different story. Most organizations settle for a DPA signed once and never reviewed. They don't verify the declared security measures. They have no visibility into how risk evolves at their subcontractors. And when an incident occurs, they discover they can't demonstrate anything.
| Fournisseur | DPA | Évaluation | Statut |
|---|---|---|---|
| Fournisseur A | Oui | Mars 2021 | Expiré |
| Fournisseur B | — | ? | Manquant |
| Fournisseur C | Oui | Juin 2022 | Expiré |
| Fournisseur D | — | — | Manquant |
| Fournisseur E | — | ? | ? |
How Conitiv structures your GDPR compliance
Structured GDPR questionnaire
Aligned with the regulation's articles. Usable for your self-assessment as well as for evaluating your subcontractors.
Cyber scoring of your third parties
Non-intrusive assessment of your suppliers' security posture. Because data security also depends on the security of those who handle the data.
Evidence centralization
DPAs, security policies, attestations, audit results — all archived in a secure space.
Evidence-based audit
Document verification by expert consultants for the most critical subcontractors.
Le RGPD impose de s'assurer que vos sous-traitants ayant accès à des données personnelles disposent d'un niveau de sécurité adéquat. Évaluer leur maturité cyber via un rating cyber dédié est désormais une composante indispensable de votre conformité RGPD.
No. Conitiv is a compliance management and subcontractor oversight tool. It complements the DPO's work by providing the assessment, scoring, and documentation tools needed to structure and demonstrate GDPR compliance.
Yes. The Conitiv GDPR questionnaire is designed to be sent directly to your subcontractors from the platform. Responses are centralized, archived, and actionable for documenting your oversight.
Cyber scoring evaluates your subcontractors' technical security posture, which is a key indicator of their ability to protect data. For a complete assessment, it is recommended to combine cyber scoring with a dedicated GDPR questionnaire and, for the most critical subcontractors, an evidence-based audit.
Ready to structure your GDPR compliance?
expert Conitiv