October 27, 2026 · GDPR
Demonstrating GDPR technical and organisational measures: a practical export case
How a Latin American exporter structures its technical and organisational measures for an EU customer, documents them traceably and reuses the evidence for later requests.
An exporter in Peru supplies a customer in Germany and, under the data processing agreement, needs to demonstrate which technical and organisational measures (TOMs) under the GDPR it has implemented. The request arrived by email with a questionnaire of around 60 points: access control, encryption, logging, deletion concepts, training and incident handling.
Rather than searching folders and memory for answers each time, the team mapped the requirements in the GDPR framework of the compliance platform Sightadel. Each requirement received a task with an owner and due date, together with the available evidence such as policies, access lists and training records. Templates for the records of processing and the deletion concept were adjusted once and have since been available for all customers.
The data stays on servers in Germany, which mattered to the EU customer. On the security side, the team added an independent review of the attack surface visible from outside through the service veyrisk, which delivers a report on open services, certificates and DNS and mail configuration. It does not replace a penetration test, but it documents the current state in a traceable way.
The benefit showed with the second request: another EU customer's questionnaire could largely be answered from the existing evidence, and only the deviations had to be added. Sightadel does not issue certificates; its value lies in organised, reusable evidence ready for audits and customer reviews. If you want to try the process with your own requirements, you can use the free trial.
