The GDPR asks not only that you protect personal data well, but also that you can show it. Tidal Control keeps your record of processing, DPIAs, processing agreements and security measures in one place, with evidence for every measure.
The GDPR has no certificate. You have to be able to show that you comply and that you keep it up. Tidal shows what is expected of your team at each step.
Step 1
Inventory
Which personal data you process, why and with which parties.
Step 2
Record of processing
Each processing activity recorded with purpose, lawful basis and retention.
Step 3
Risk and DPIA
Risks assessed and a DPIA carried out where the processing calls for it.
Step 4
Measures and agreements
Security, processing agreements and privacy notice in order.
Step 5
Procedures
Ready for data subject requests and for reporting a breach within 72 hours.
After that
Maintain and review
Record, DPIAs and agreements kept current, and a sparring partner for new processing.
Accountability means you not only comply with the GDPR but can also demonstrate it. Tidal sets up the duties for you, with an owner, policy and evidence for each part.
GDPR duties
Art. 30
Record of processing
Each processing activity with purpose, lawful basis, recipients and retention.
Art. 35
DPIA
A data protection impact assessment for high-risk processing.
Art. 15-22
Data subject rights
Requests for access, rectification or erasure handled on time.
Art. 28
Processors
A processing agreement with every party that processes data for you.
Art. 32
Security
Appropriate technical and organisational measures.
Art. 33-34
Data breaches
Reported to the supervisory authority within 72 hours, and to data subjects where needed.
The General Data Protection Regulation (GDPR) applies to every organisation that processes personal data of people in the EU. Its core is accountability: you have to be able to demonstrate that you comply. Each member state has a supervisory authority; in the Netherlands that is the Autoriteit Persoonsgegevens.
From record of processing to breach reporting: your privacy programme in one place.
Risk assessment
Turn risk assessment from a time-consuming task into a guided process that helps your business grow. Our AI-powered platform learns from your company's context to help assess and manage risks - even if you're new to the process.
Risk assessment in Tidal Control
Policy center
Turn policy management from a complex, time-consuming task into an automated process that grows with your business. Start with our pre-written policies designed for modern companies, or import your existing documents - either way, you'll benefit from smart automation that keeps everything on track.
Policy center in Tidal Control
Vendor management
Record for each supplier which personal data it processes, whether there is a processing agreement and when you review it again.
Vendor management in Tidal Control
Issues management
Record a data breach with timeline, impact and handling, so you can decide within 72 hours whether and how to report it.
Issues management in Tidal Control
Controls management
Simplify control management with flexible, automation-ready tools that adapt to your needs. Start with our control library or build your own - either way, you'll get powerful automation, clear ownership, and real-time insights.
Controls management in Tidal Control
Personnel & onboarding
The Personnel module turns employee compliance (onboarding, policy acknowledgements, role assignments) into a self-service flow for your team. No more chasing email confirmations or maintaining a separate spreadsheet of who has accepted which policy.
Personnel & onboarding in Tidal Control
Integrations
Our integrations collect and evaluate evidence for you, saving you the time of preparing system reports and screenshots every time you need to run a control test.
Integrations in Tidal Control
The GDPR applies everywhere, but its weight differs by sector. See how Tidal fits your practice.
Record of processing
Manual
A spreadsheet that goes stale
With Tidal
A record with owners and review dates
DPIAs
Manual
Separate documents
With Tidal
Template linked to risks and measures
Processing agreements
Manual
Spread across folders and email
With Tidal
Recorded per supplier
Data breaches
Manual
Looking for information when it goes wrong
With Tidal
Recorded with a timeline, ready to report
GDPR and ISO 27001
Manual
Two projects side by side
With Tidal
One set of measures, evidence once
Testimonials
With a single click, one Tidal test checks dozens of disks for encryption. Doing that manually would take a lot of time.
Frameworks that help you demonstrate the GDPR, or that often sit next to it.
A certifiable privacy management system on top of ISO 27001 that maps to the GDPR.
The security measures Article 32 asks for, in a certifiable system.
In Dutch healthcare, the standard for securing patient data.
If you use personal data in AI, ISO 42001 helps you keep it under control.
Learn more about implementing and managing GDPR
Terms that help you demonstrate GDPR compliance.
The GDPR asks for more than compliance: you have to be able to demonstrate it. That means a current record of processing, DPIAs where needed, processing agreements, procedures for requests and breaches, and evidence that your security works.
In documents and spreadsheets that goes stale quickly. A new supplier or a new processing activity does not get added by itself, and when the supervisory authority asks, the search begins.
GDPR compliance software keeps those parts together, with owners and review dates. You know at any moment what is in place and what is missing.
The GDPR has no mark that declares you compliant. You show it with evidence: a current record of processing, DPIAs where they are needed, processing agreements, a working procedure for data subject requests and security measures that demonstrably run. In Tidal that evidence hangs off the matching controls, with an owner and a date.
Report a personal data breach without undue delay and, where feasible, within 72 hours to the supervisory authority, unless it is unlikely to pose a risk to the people involved. If the risk is high, inform the data subjects themselves as well. Record every breach, even when you do not report it. In Tidal you do that in the Issues module.
Only for processing that is likely to result in a high risk, such as large-scale processing of health data, systematic monitoring or profiling with significant effects. Supervisory authorities publish lists of processing for which a DPIA is required. In Tidal you record the DPIA with a template and link it to your risks.
Yes, our platform includes tools for tracking and managing data subject requests, maintaining response timeframes, and documenting your processes. This helps demonstrate compliance with GDPR requirements while building evidence for BC5701 certification.
