Who it applies to
- Any company processing personal data of people in the EU.
- SaaS companies with EU customers, employees, or users.
- Processors and controllers that need to show security and accountability.
What you need to do
- Appropriate technical and organizational security measures.
- Processor and vendor management, data-subject rights, breach response, and records of processing.
- Evidence that privacy controls and security controls are actually operating.
How Kaamos helps
- Connects privacy-relevant assets, vendors, and controls into one operating view.
- Keeps GDPR security work aligned with ISO 27001, NIS2, and customer questionnaires.
- Maintains evidence for security controls without screenshot scrambling.