This is the foundation. Before you build anything else, you need the governance infrastructure: Records of Processing Activities (Article 30), a DPO mandate, DPIA processes, and documented organisational measures.

Without this, every other compliance effort has no structure to sit on.

Article 32 gets the most attention here — "appropriate technical and organisational measures." But this theme also pulls in encryption and pseudonymisation requirements from Article 34, processor security obligations from Article 28, and access restrictions for special category data under Article 9.

If your security controls are designed only around Article 32, you are missing obligations scattered across ten other articles.

The 72-hour breach notification rule (Article 33) is well known. What is less obvious: this theme also covers purpose-change notifications (Article 13/14), erasure propagation to third parties (Article 17/19), and restriction-of-processing updates (Article 18).

These are all notification obligations. They share the same infrastructure: event detection, assessment logic, multi-party routing, and deadline tracking.

If you transfer personal data outside the EU — and if your servers are outside Europe, you do — you need a transfer register, documented safeguards (SCCs, BCRs, or adequacy reliance), and ongoing monitoring of adequacy decisions.

This theme also pulls in disclosure obligations from Articles 14 and 15: you must tell data subjects where their data goes and what safeguards apply.

Access, rectification, erasure, portability, restriction, objection, and human review of automated decisions. Each right has its own article, but they all need the same operational capability: intake, identity verification, fulfilment workflow, deadline tracking, third-party coordination, and audit logging.

Build this as one system. Not seven.

Every processing activity needs a lawful basis (Article 6). If that basis is consent, the GDPR demands it be freely given, specific, informed, and unambiguous (Article 7) — with extra rules for children (Article 8) and special categories (Article 9).

This is not a checkbox. It is a system: consent capture, granular purpose tracking, withdrawal mechanisms, and proof of consent at any point in time.

If your organisation adheres to approved codes of conduct, certifications, or Binding Corporate Rules, the GDPR requires you to prove ongoing compliance — not just initial adherence. This includes monitoring body functions, staff training verification, and BCR change management.

For most startups this is a later-stage concern. But if you are pursuing certification or operating under BCRs, treat it as a distinct workstream.