GDPR Article 32
Attestkeep maps what your cluster's admission control and image scanning recorded in a period to 6 clauses of Regulation (EU) 2016/679. 4 are assessed from those records; 2 are marked outside scope, each with the reason.
4 clauses a cluster can answer.
Citations and titles as the report prints them. Open a clause to read what it asks, restated close to the instrument's own words.
General Data Protection Regulation
Regulation (EU) 2016/679
Article 32 — security of processing
| Citation | Clause | Report sections |
|---|---|---|
| Article 32(1)(b) |
Ongoing confidentiality, integrity, availability and resilienceThe ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services. |
CoverageAdmission decisionsOutcomesSupply chainControl statement |
| Article 32(1)(d) |
Regular testing, assessing and evaluating of the measuresA process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing. |
AvailabilityEvidence chainControl statementIssues |
| Article 32(2) |
Risks presented by the processingIn assessing the appropriate level of security, account shall be taken of the risks presented by processing, in particular from unauthorised disclosure of, or access to, personal data. |
Control statementAdmission decisionsTriage decisions |
| Article 32(4) |
Persons acting under authorityThe controller and processor shall take steps to ensure that any natural person acting under their authority who has access to personal data does not process it except on instructions. |
Evidence chain |
2 clauses marked outside scope, and why
| Citation | Clause and reason |
|---|---|
| Article 32(1)(a) | Pseudonymisation and encryption of personal data encryption and pseudonymisation are properties of the data and of the application handling it; an admission control governs which software may run, not what that software does with a record |
| Article 32(1)(c) | Restoring availability and access after an incident backup and restoration of personal data are the controller's own; this document reports the availability of the admission control, not of the data |
Evidence from records the cluster already keeps.
Nothing is filled in by hand. Each clause's answer carries a status (met, partial, gap or outside scope), a note with the period's own numbers, and the report sections those numbers come from.
Statements the mapping draws on
Each assessed clause is answered by one or more of these statements about the period's records. The same statement answers the same question under every framework, so two reports for one period cannot disagree.
- Every decision and administrative action is recorded2 clauses
- Administrative access is federated to a directory1 clause
- Admission refuses non-compliant workloads1 clause
- The control itself was operating throughout the period1 clause
- Accepted risks are named, justified and expire1 clause
- Only images of established provenance may run1 clause
- Images may enter only from named registries1 clause
- Remediation windows are declared for each severity1 clause
- Every image in the inventory carries a scan record1 clause
- Images carrying severe findings are refused1 clause
- Workload privilege is constrained at admission1 clause
What the report contains.
Every package carries the same sections, whatever the framework. The ones marked are those GDPR Article 32 answers cite, with the number of clauses citing each.
- Organisation
- Framework mapping
- Cluster
- Control statement3
- Coverage1
- Vulnerability findings
- Outcomes1
- Admission decisions2
- Supply chain1
- Triage decisions1
- Break-glass events
- Availability1
- Evidence chain2
- Deployment context
- Issues1
- Ledger
- Population
- Runtime events
- Producer statements (VEX)
The scope paragraph, as the report states it.
This document reports what one Kubernetes cluster's admission control and image scanning recorded during the period, mapped onto Article 32 of Regulation (EU) 2016/679. Article 32 requires technical and organisational measures appropriate to the risk of the processing. Evidence that the systems processing personal data are patched, that only known software runs on them, and that the control operates continuously speaks to Article 32(1)(b) and (d) and to Article 32(2). It is not evidence of a lawful basis, of data subject rights, of transfers or of any other obligation in the regulation, and no such claim is made here.
About GDPR Article 32 and Attestkeep
Is this a GDPR Article 32 certification?
No. The package is evidence produced from your cluster's own records. It is not a certification, and no auditor is obliged to accept it. The scope paragraph on this page is the one the report itself carries.
Why are 2 of the clauses outside scope?
They ask about things one cluster's admission and scanning records cannot show. They are listed with the reason rather than left out, so whoever reads the report can see the gap is deliberate.
Which plan includes GDPR Article 32?
Every plan can report against it. Community and Team include one framework of your choice, Business three, Enterprise every one. Prices are on the pricing page.
How does an auditor check the package?
In a browser at attestkeep.com/verify.html, where nothing is uploaded, or with the short script on the documentation site. Neither needs us. For auditors has the details.
Install it yourself.
Create an account, confirm your e-mail with the code we send, take the free Community key from the Licenses page, and install with Helm.
Create an account