GDPR operational records
Maintain private privacy-workflow records and their supporting decisions without treating the workspace as legal approval or automatic regulatory filing.
Use the private workspace
Enable GDPR in the full edition and define the processing scope. Use its operational records for the supported processing, request, incident and review workflows.
Assign an owner, maintain the required dates and statuses, and link minimized supporting evidence. Check the workflow's validation messages before changing a record's state.
Keep decisions attributable
Document the organization's legal and privacy decisions separately from a technical check result. A deadline reminder or generated starter does not decide a lawful basis, approve a transfer or submit a notice to a regulator.
Do not put unnecessary personal data or credentials into records or attachments. Access remains subject to Sparta's existing roles and record rules.
Share deliberately
Privacy registers are restricted to administrators and assigned owners. External auditors cannot read them, and they are excluded from shared audit packages and trust-center publication. Use the separate private JSON export only when authorized and transfer it securely.
Do not copy personal request or incident details into the public trust center.
Review the intended scope and contents before exporting material for an auditor. Obtain qualified privacy advice for legal determinations.
ISO 42001 AI governance
Define the AI management system scope, review the AI controls and retain assessment and approval evidence for the systems you actually operate.
Singapore PDPA evidence
Organize Singapore PDPA-mapped controls and evidence while retaining the organization's privacy decisions and operating records.