Frameworks · GDPR · evidence mapping
Build on your privacy records when reviewing GDPR.
Asiri helps connect your existing privacy records to GDPR requirements. Its mapping is a self-assessment, not certification. GDPR Articles 42–43 provide for certification through approved mechanisms; an Asiri assessment does not replace that process.
Evidence mapping
Self-assessment
Article by section
Compare the requirements and supporting records
Some records can support work under both laws. Use this comparison as a starting point and check the requirements that apply to your processing; a mapping is not a finding of compliance.
GDPR
NDPA 2023
Lawful processing
Identify the conditions that apply to each purpose.
Lawful basis records
Use your activity and basis records as evidence to review, not as automatic equivalence.
People’s rights
Check the request, applicable right and response requirements.
Privacy request records
Keep the request and decisions together; confirm the applicable rules for each case.
Processing documentation
Review the processing within scope.
Activity register
Use purposes, data categories, recipients and retention information to support the review.
Breach response
Assess the notification threshold and relevant obligations.
Incident register
Preserve the facts and advice behind each notification decision.
Privacy risk
Review assessment requirements for the intended processing.
Impact assessments
Existing evidence may help, but confirm the scope and requirements separately.
International transfers
Assess the transfer route and applicable safeguards.
Transfer register
Document the origin, destination and grounds for each transfer. Do not assume one mechanism covers both regimes.
Where they part company
Check these points when assessing your scope
Work through these questions with your adviser before relying on a framework mapping.
Scope
Which processing is covered?
Identify the activities, establishments and people involved. Selling to an EU customer alone does not explain every part of the territorial-scope assessment.
Responsibility
What role does each organisation play?
Record who determines the purpose of processing and who acts on instructions. Check the relevant agreements.
Evidence
What can you support with records?
Review the evidence for each applicable requirement. Keep gaps visible and assign follow-up work.
Assurance
What does your public claim cover?
Distinguish a self-assessment from certification. Name the assessed scope and actual issuer where certification is claimed.
What your badge will say
Describe the assessment you actually completed
Show the scope, date and evidence behind your assessment so a customer or adviser can understand what it covers.
Refused
GDPR certified · GDPR compliant
An Asiri mapping alone does not support either claim. Any certification claim needs the actual scheme, issuer and assessed scope.
Printed instead
GDPR self-assessment · [n] of [articles assessed] evidenced · dated [the day it ran]
Your figures, read on the day the badge is cut, with every unevidenced article named on the page rather than omitted from it. No specimen count is shown here: a number on this page is a number somebody quotes.
Serving EU customers from Lagos? Start from what you have.
Asiri will map your registers onto the Regulation article by article, evidence what it can read, and name what is genuinely additional work.
Primary reference: GDPR: Articles 42–43 on certification. Review the source alongside your organisation’s circumstances.