GDPR
Know where personal data lives before someone asks
A record of processing activities written once and never revisited is worse than none at all. Gwenda derives yours from the systems that hold the data, and tells you when reality moves away from the document.
Know where personal data lives before someone asks
Gwenda maps the systems processing personal data and tests the controls around them, then keeps your records of processing, retention rules and breach readiness aligned with what your infrastructure is actually doing.
Discovery
What Gwenda finds, and where it finds it
Every finding names the system it came from. That is what makes it evidence rather than an assertion.
Which systems hold personal data
Databases, storage buckets, SaaS applications and file shares containing personal or special-category data, including the ones nobody put on the register. Read from AWS, Azure, Google Cloud, Google Workspace, Microsoft 365.
Who can reach it
Access paths to personal data by role and by individual, including broad group grants and external sharing that has quietly accumulated. Read from Entra ID, Okta, Google Workspace.
Where data leaves the organisation
Third-party applications with data access, the scopes they hold, and which of them sit outside the EEA. Read from OAuth grants, SaaS admin consoles.
Whether retention is actually enforced
Lifecycle rules, deletion jobs and backup retention compared against the periods your policy claims. Read from Cloud storage lifecycle policies, database configuration.
Encryption in transit and at rest
Storage encryption, TLS configuration and key management for every store holding personal data. Read from AWS, Azure, Google Cloud.
The benchmark
The Gwenda gold standard for privacy
A record of processing that matches the systems you actually run, lawful bases recorded per activity, retention that is actually enforced, and a breach assessment you can complete inside the statutory clock, under both the GDPR and the Australian Privacy Act.
- Data mapping that stays current
- Every system holding personal data identified, categorised by data type and special category, with the flows between them and out to processors.
- Lawful basis and consent
- A recorded basis for each processing activity, and where consent is relied on, evidence that it was freely given, specific and withdrawable.
- Retention and deletion
- Retention periods defined per data category and demonstrably enforced by the system holding the data, not a policy that says seven years while the database says forever.
- Data subject rights
- Access, correction, erasure and portability requests fulfillable within statutory timeframes, with a repeatable process and a record of each response.
- Processors and transfers
- A current register of processors and sub-processors, the contractual terms in place, and the mechanism relied on for any transfer out of the EEA.
- Breach readiness
- Detection, assessment and notification able to be completed within 72 hours for the GDPR, and inside the Notifiable Data Breaches assessment window for Australia.
Illustrative figures. Yours are measured from your own systems.
How it works
The same four moves, applied to your obligations.
- 01
Connect
Point Gwenda at the systems you already run: identity, cloud, endpoints, code, HR, rostering, ticketing.
- 02
Discover
Gwenda reads those applications and works out which controls you already have in place.
- 03
Benchmark
Your posture is scored against Gwenda's gold standard for your industry.
- 04
Remediate
Every gap arrives already owned, with the specific action that closes it and the evidence that will prove it is done.
Outcomes
What changes for you
A record of processing that maintains itself
Derived from the systems in scope, so it stops being a document that was accurate on the day it was written.
Answer a data subject request without a fire drill
Know which systems hold a person's data before you start looking, and record what you did with each request.
A defensible breach clock
When something happens, you already know what the system held, who could reach it and how long it was exposed, which is most of the 72-hour assessment.
One programme, two regimes
Controls proven for the GDPR count towards the Australian Privacy Principles where they overlap, so an organisation subject to both runs one programme.
Integrations
Where the evidence comes from
Read-only connections to the systems you already run.
Microsoft Entra ID
Privileged role assignments
Amazon Web Services
IAM roles, policies and root account MFA
Wiz
Cloud misconfiguration and exposure findings
Microsoft Sentinel
Connected data sources and coverage gaps
Microsoft 365
Mailbox and SharePoint sharing
Okta
Sign-on policies and MFA factors
Microsoft Azure
Subscription role assignments
Tenable
Vulnerability findings by severity and age
Splunk
Log source coverage and ingestion gaps
Microsoft SharePoint
Site and file sharing permissions
Google Workspace
Super admin accounts
Google Cloud
IAM bindings and service accounts
The hardest question in a privacy programme is "where is the personal data, right now, and who can reach it". What the policy should say comes second.
That question has an answer, and the answer is sitting in your cloud accounts, your identity provider and your SaaS admin consoles. Gwenda's job is to go and get it, and to notice when it changes.
Questions we get asked
We are Australian. Does the GDPR apply to us?
It can. The GDPR reaches organisations outside the EU that offer goods or services to people in the EU, or monitor their behaviour. If you have EU customers or users, assume it applies until you have advice saying otherwise. Gwenda runs the Australian Privacy Act alongside it, so you are not choosing between them.
Does Gwenda read the contents of our data?
No. Gwenda reads configuration and metadata (where stores are, how they are secured, who can reach them, what retention is set). It does not read the personal data inside them.
Can Gwenda produce our record of processing activities?
It produces the system-derived portion (the stores, categories, flows, processors and controls). The business context around each activity, such as purpose and lawful basis, is recorded once in Gwenda and then kept alongside the technical picture.
See what Gwenda finds in your gdpr posture.
Thirty minutes, your systems or ours. We'll show you what it discovers and where you sit against the gold standard.