CertRadar

Compliance evidence

GDPR — domain & certificate controls

Any organization offering goods or services to EU data subjects, or monitoring their behavior — regardless of where the organization is headquartered.

Authority: European Commission / national DPAs

What GDPR actually requires

GDPR Article 32 (Security of processing) requires appropriate technical and organizational measures including encryption. Article 5(1)(f) requires integrity and confidentiality. While GDPR is technology-neutral, the European Data Protection Board's guidance on encryption cites TLS as a baseline technical measure for data in transit.

Full name: GDPR (General Data Protection Regulation, EU 2016/679).

Controls that touch certificates and domains

These are the 3 controls most directly affected by TLS certificate and domain lifecycle. CertRadar produces evidence bundles mapped to each.

ControlTitleHow CertRadar helps
Art. 32(1)(a)Pseudonymisation and encryption of personal dataTLS encryption of data in transit is a named example of appropriate technical measures.
Art. 32(1)(d)Process for regularly testing, assessing, and evaluating the effectiveness of technical measuresContinuous certificate monitoring is part of testing encryption effectiveness.
Art. 5(1)(f)Integrity and confidentiality (security)Unexpired, trusted TLS certificates are the standard mechanism ensuring confidentiality in transit.

What the evidence pack contains

CertRadar’s one-click export for GDPR includes:

Example domains in GDPR scope

Representative domains often monitored for GDPR evidence. Check any of them live:

Ship the GDPR evidence your auditor asks for.

CertRadar gives security, IT, and compliance teams a complete inventory of every domain and cert your company owns — plus a one-click evidence pack mapped to GDPR controls. Beta in weeks. Early members get a lifetime Pro discount.

Join the waitlist

Other frameworks