Docs

Appearance

Operationalizing GDPR in Modulos ​

Modulos has two Frameworks for the GDPR, Regulation (EU) 2016/679, and each of the two Frameworks has the name GDPR:

  • OFF-11 at the Organization level, on your organization AI System.
  • MFF-12 at the AI System level, on each AI System that processes personal data in the scope of the GDPR.

This page tells you which decisions to make before you add the Frameworks, and which steps Modulos recommends. It also gives the Requirement for each Article, and the work that has no Requirement. On this page, "you" is the organization that uses Modulos, as controller, as processor, or in the two roles. First examine if the GDPR applies to your processing. See Where the GDPR applies.

The two GDPR Frameworks ​

In Modulos, the GDPR has two Frameworks at two levels. The two levels are the structure of Modulos, and the GDPR does not have this structure.

AI SystemFrameworkGDPR Articles in the Framework
The organization AI SystemOFF-11 (Organization level)5 to 14, 23, 24, 26 to 31, 33 to 47, 49, and 51 to 99
Each AI System in the scope of the GDPRMFF-12 (AI System level)15 to 22, 25, and 32
  • Each Article is in one Framework only. MFF-12 includes the data subject rights of Articles 15 to 22, data protection by design and by default (Article 25), and security of processing (Article 32). OFF-11 includes all other Articles in the table. Examples are the legal basis (Article 6), the information to data subjects (Articles 13 and 14), and the data protection impact assessment (Article 35).
  • No Requirement includes Articles 1 to 4, 48, or 50. The scope and role decisions have no Requirement. See Work with no Requirement in the Frameworks.
  • The two levels do not follow the roles of the GDPR. Some Articles also set obligations for processors, for example Articles 30(2), 31, 33(2), and 37(1). The GDPR Role tags show the roles for each Requirement. See GDPR Role tags.

Organization AI Systems

Frameworks at the Organization level, for example OFF-11, attach to your organization AI System. You cannot make a new organization AI System in the AI Registry. If your organization does not have one, contact Modulos support before you add Frameworks at the Organization level.

Decisions before you add the Frameworks ​

Before you add the GDPR Frameworks, make these four decisions. The GDPR sets no sequence for them, and Modulos recommends this sequence. Decisions 1 and 2 have no Requirement in the GDPR Frameworks.

  1. Examine if the GDPR applies to your processing (Articles 2 and 3).
  2. Identify your role for each processing activity (Article 4(7) and (8)).
    • See Controllers and processors.
    • Examine your role again when an AI System gets a new purpose or category of personal data. Also examine your role when a new organization supplies the AI System or a part of it. Modulos recommends this step, and Article 4 does not make it an obligation.
  3. Select the AI Systems that get MFF-12.
    • Modulos recommends MFF-12 for each AI System that processes personal data in the scope of the GDPR (decision 1).
    • If an AI system in the scope has no AI System in Modulos, make one in the AI Registry.
  4. Examine if you must designate a representative in the Union (Article 27, ORF-235).
    • Where Article 3(2) applies, the controller or the processor must designate “in writing” a representative in the Union (Article 27(1)). Article 27(2) gives two conditions in which this obligation does not apply. See Article 27.

GDPR Role tags ​

In Modulos, each Requirement of OFF-11 and MFF-12 has one or two tags of the type "GDPR Role". The tag values are "Controller" and "Processor":

  • "Controller" is for a Requirement that applies to a controller in Article 4(7).
  • "Processor" is for a Requirement that applies to a processor in Article 4(8). This includes a processor that a different processor engages, in Article 28(2) and (4).
RequirementGDPR Role tags
MRF-242, ORF-235 to ORF-239, and ORF-243 to ORF-255"Controller" and "Processor"
All other Requirements of OFF-11 and MFF-12"Controller"

Your organization identifies its role for each processing activity, in decision 2 of Decisions before you add the Frameworks. The GDPR Role tags are different from the ISO 27701 Role tags of the ISO/IEC 27701 Frameworks.

Modulos wants to use these tags in a new release. The purpose is to remove a Requirement from the scope when the organization does not have the role of that Requirement.

Steps that Modulos recommends ​

To use the GDPR Frameworks, Modulos recommends the 13 steps below, in this sequence. The GDPR sets no sequence. Steps 1 and 2 are decisions 1 and 2 of Decisions before you add the Frameworks. Each step gives the Requirements and the page for the law.

  1. Examine if the GDPR applies to your processing. This decision has no Requirement.
  2. Identify your role for each processing activity. This decision has no Requirement.
  3. Add the Frameworks. Add OFF-11 to your organization AI System. Add MFF-12 to each AI System that you selected in decision 3.
  4. Do the work for the principles and the legal basis (ORF-225 to ORF-230).
    • These Requirements include Articles 5 to 11, from the principles (Article 5) to processing for which identification is not necessary (Article 11).
    • Modulos recommends that you record the legal basis for each purpose. Article 6 does not make this record an obligation. The record helps the controller demonstrate compliance with the principles (Article 5(2)) and with the GDPR (Article 24(1)).
    • Where the legal basis is consent, it must be possible for the controller to demonstrate the consent of the data subject (Article 7(1)).
    • See Article 5, Article 6, Articles 7 and 8, Article 9, and Articles 10 and 11.
  5. Do the work for information and data subject rights (ORF-231, ORF-232, MRF-233 to MRF-240).
  6. Use the Article 23 restrictions only where a law gives them (ORF-233).
    • Check the conditions of the legislative measure before you use a restriction.
    • See Article 23.
  7. Do the work for accountability, joint controllers, processors, and records (ORF-234 to ORF-237).
  8. Do the work for data protection by design and by default, and for security, on each AI System (MRF-241, MRF-242).
    • Select measures for the controller’s Article 25 obligations and the controller’s and processor’s Article 32 obligations.
    • See Article 25, Article 32.
  9. Do a data protection impact assessment (DPIA) where Article 35(1) applies (ORF-241, ORF-242).
    • Check the processing against Article 35, with its exceptions, and Article 36 before processing starts.
    • Include the data protection officer’s advice where designated and the supervisory authority’s “list” in Article 35(4) in this check.
    • See Article 35, Article 36.
  10. Prepare for personal data breaches (ORF-239, ORF-240).
    • Prepare the notification, communication, and breach records for your role, with the time limits, exceptions, and conditions of each Article.
    • See Article 33, Article 34.
  11. Do the work for the data protection officer, codes of conduct and certification, and transfers (ORF-243 to ORF-249).
  12. Prepare to cooperate with the supervisory authority (ORF-238, ORF-250 to ORF-253).
  13. Examine the work again when the processing changes.
    • Check the Article 24(1) measures again where necessary.
    • Check the processing against the DPIA where necessary, and as a minimum when the risk changes (Article 35(11)).
    • Your organization sets the schedule.
    • See Article 24, Article 35.

Reviews in Modulos ​

In Modulos, you do the work of each GDPR Requirement in its Controls. You change the status of a Control directly. You must write a comment, which Modulos records for the Control. No approval by a different person is necessary.

When all Controls of a Requirement have a final status, the Requirement Owner examines the completed Controls in a Review. The Requirement Owner records that the Requirement is completed. For Assets only, Modulos has a procedure that starts a Review. See Reviews & Statuses.

Requirements of the GDPR Frameworks ​

OFF-11 and MFF-12 give Requirements for Articles 5 to 99 of the GDPR, without Articles 48 and 50. In the table, each Requirement has its name in Modulos, its level, its GDPR Articles, and the page for the law.

RequirementLevelGDPR ArticlesPage for the law
MRF-233 Right of Access ImplementationAI System15Articles 15 to 21
MRF-234 Right to RectificationAI System16Articles 15 to 21
MRF-235 Right to Erasure (Right to be Forgotten)AI System17Articles 15 to 21
MRF-236 Right to RestrictionAI System18Articles 15 to 21
MRF-237 Notification ObligationAI System19Articles 15 to 21
MRF-238 Data PortabilityAI System20Articles 15 to 21
MRF-239 Right to ObjectAI System21Articles 15 to 21
MRF-240 Automated Decision-Making ProtectionAI System22Article 22
MRF-241 Privacy by Design and DefaultAI System25Article 25
MRF-242 Security of ProcessingAI System32Article 32
ORF-225 Processing Principles ImplementationOrganization5Article 5
ORF-226 Lawful Basis DocumentationOrganization6Article 6
ORF-227 Consent Management FrameworkOrganization7, 8Articles 7 and 8
ORF-228 Special Categories ProtectionOrganization9Article 9
ORF-229 Criminal Conviction Data ProcessingOrganization10Articles 10 and 11
ORF-230 Processing Not Requiring IdentificationOrganization11Articles 10 and 11
ORF-231 Transparent Information and CommunicationOrganization12Articles 12 to 14
ORF-232 Information Provision RequirementsOrganization13, 14Articles 12 to 14
ORF-233 Restrictions FrameworkOrganization23Article 23
ORF-234 Controller AccountabilityOrganization24Article 24
ORF-235 Joint Controllers and RepresentativesOrganization26, 27Article 26, Article 27
ORF-236 Processor ManagementOrganization28, 29Article 28, Article 29
ORF-237 Records of Processing ActivitiesOrganization30Article 30
ORF-238 Cooperation with Supervisory AuthorityOrganization31Article 31
ORF-239 Breach Notification to AuthorityOrganization33Article 33
ORF-240 Breach Communication to Data SubjectOrganization34Article 34
ORF-241 Data Protection Impact AssessmentOrganization35Article 35
ORF-242 Prior ConsultationOrganization36Article 36
ORF-243 Data Protection OfficerOrganization37 to 39Articles 37 to 39
ORF-244 Codes of Conduct and CertificationOrganization40 to 43Articles 40 to 43
ORF-245 General Transfer PrincipleOrganization44Articles 44 to 49
ORF-246 Adequacy DecisionsOrganization45Articles 44 to 49
ORF-247 Appropriate SafeguardsOrganization46Articles 44 to 49
ORF-248 Binding Corporate RulesOrganization47Articles 44 to 49
ORF-249 Transfer DerogationsOrganization49Articles 44 to 49
ORF-250 Supervisory Authority FrameworkOrganization51 to 59Supervisory authorities
ORF-251 Cooperation and ConsistencyOrganization56, 60 to 76Supervisory authorities
ORF-252 Remedies and LiabilityOrganization77 to 82Remedies and liability
ORF-253 Administrative Fines and PenaltiesOrganization83, 84Administrative fines and other penalties
ORF-254 Specific Processing SituationsOrganization85 to 91GDPR, Articles 85 to 91
ORF-255 Delegated Acts and Final Provisions ComplianceOrganization92 to 99GDPR, Articles 92 to 99

Work with no Requirement in the Frameworks ​

The GDPR Frameworks OFF-11 and MFF-12 have no Requirement for Articles 1 to 4, 48, or 50.

  • The scope decision and the role decision. Your organization makes these decisions. See decisions 1 and 2 of Decisions before you add the Frameworks.
  • Articles 48 and 50. Article 48 is about “Transfers or disclosures not authorised by Union law”. Article 50 is about “International cooperation for the protection of personal data”, which is a task of the Commission and the supervisory authorities. These Articles give no transfer mechanism to a controller or processor.

Other sources to examine ​

When you apply the GDPR Requirements, examine the sources below. Articles with a Requirement can also have conditions in Union or Member State law.

  • Member State law. The GDPR lets Union or Member State law add rules in some areas. Examine the law that applies to your processing. Examples are:

    • a “lower age” than 16, but “not below 13 years”, for the processing in Article 8(1). This applies where Article 6(1)(a) is the legal basis, “in relation to the offer of information society services directly to a child”.
    • more conditions for genetic data, biometric data, or data concerning health (Article 9(4))
    • restrictions (Article 23)
    • a prior consultation and a “prior authorisation” for a task in the public interest (Article 36(5))
    • the designation of a data protection officer (Article 37(4))
    • specific processing situations (Articles 85 to 91).

    See Dates and rules of the GDPR.

  • Court decisions and guidelines. The Court of Justice of the European Union and the European Data Protection Board give decisions and guidelines about the GDPR. See court decisions and guidelines.

  • Chapters IX to XI. ORF-254 is for Articles 85 to 91, the provisions for “specific processing situations”. For example, Member States can give “more specific rules”, “by law or by collective agreements”, for processing “in the employment context” (Article 88(1)). Processing for “archiving purposes in the public interest, scientific or historical research purposes or statistical purposes” is “subject to appropriate safeguards” (Article 89(1)). ORF-255 is for Articles 92 to 99, which are “Delegated acts and implementing acts” (Chapter X) and “Final provisions” (Chapter XI). See GDPR, Articles 85 to 99.

  • The Digital Omnibus proposal. This proposal of 19 November 2025 has changes to, for example, Articles 9, 22, 33, and 35, and is not law as of October 2026. See The Digital Omnibus proposal.

  • Procedure of the supervisory authorities. Regulation (EU) 2025/2518 applies from 2 April 2027, with the “Transitional provisions” in Article 36. See Procedure for supervisory authorities.

Other Frameworks on the same AI Systems ​

Modulos also has Frameworks for the EU AI Act and for ISO/IEC 27701, which can apply together with the GDPR Frameworks:

OFF-1 and OFF-12 attach to the same organization AI System as OFF-11. MFF-1 and MFF-13 attach to AI Systems, and these can be the same AI Systems that have MFF-12. For the Controls that are in the GDPR Frameworks and also in other Frameworks, see Control overlap.

The GDPR and the EU AI Act can apply to the same AI system (EU AI Act Article 2(7)).

ISO/IEC 27701 is a standard, and conformity with it is optional. Conformity with ISO/IEC 27701 is not the same as compliance with the GDPR, because the GDPR sets the conditions of each obligation. See ISO/IEC 27701 and the GDPR.

Where to go next ​

GDPR overview

Dates of the GDPR, its structure, and the EU AI Act

Where the GDPR applies

Articles 2 to 4, the Article 27 representative, and the roles of controller and processor

Principles and rights of data subjects

Principles, lawfulness of processing, consent, special categories, information, data subject rights, and Articles 22 and 23

Obligations of controllers and processors

Accountability, processors, records, security, personal data breaches, the DPIA, the data protection officer, and transfers

Supervisory authorities, remedies, and penalties

Supervisory authorities, the lead supervisory authority, remedies and liability, and administrative fines

Reviews & Statuses

How the status of a Control changes and how the Requirement Owner examines a Requirement

Sources of this page ​

  • GDPR, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (EUR-Lex).
    • OJ L 119, 4.5.2016, p. 1. Corrigendum: OJ L 127, 23.5.2018, p. 2.
    • Articles in Chapters I to III: 2 to 4, 5(2), 7(1), 8(1), 9(4), 12(3), 22, and 23(1).
    • Articles in Chapter IV: 24 to 28, 30 to 37, 40, and 42(3).
    • Articles in Chapters V to IX: 44 to 50, 60(10), and 85 to 91.
  • EU AI Act, Regulation (EU) 2024/1689, consolidated text of 27 July 2026: Article 2(7) (EUR-Lex).
  • Digital Omnibus proposal, European Commission, COM(2025) 837 of 19 November 2025: Article 3 (EUR-Lex).
  • Regulation (EU) 2025/2518, OJ L, 12.12.2025: Articles 1, 36, and 37 (EUR-Lex).

Disclaimer

This page gives general information only. It is not legal advice.