The GDPR tool that flags your obligations at pre-assessment

No. The GDPR is a directly applicable regulation: you comply with it, you do not hold a certificate for it. Article 42 does provide for certification mechanisms, seals and marks, issued against criteria approved by a supervisory authority or by the European Data Protection Board, but they cover defined processing operations, never the organisation as a whole. For a certificate at organisation level, the recognised route is ISO/IEC 27701, the privacy information management standard that works alongside ISO/IEC 27001: useful evidence of maturity, but not proof of GDPR compliance.

Article 37 of the GDPR makes a DPO mandatory in three cases: public authorities and bodies, organisations whose core activities involve regular and systematic monitoring of individuals on a large scale, and organisations whose core activities involve large-scale processing of special category data or data on criminal convictions. The 250-employee threshold people often quote has nothing to do with the DPO: it frames a partial exemption from the record-keeping duty, which falls away as soon as processing is not occasional, as with payroll or HR.

Whenever processing is likely to result in a high risk to the rights and freedoms of individuals. The GDPR names three situations that always trigger one: systematic and extensive automated evaluation of personal aspects used as the basis for decisions with legal effects, large-scale processing of special category or criminal data, and systematic monitoring of a publicly accessible area on a large scale. Each supervisory authority publishes its own list of operations requiring a DPIA, and some, the CNIL among them, also list operations exempt from it.

They are two separate regimes. The GDPR protects personal data and grants rights to individuals; the EU Artificial Intelligence Act classifies AI systems by risk level, including where no personal data is processed at all. They meet on an AI system that handles personal data: lawful basis, minimisation and the DPIA still follow from the GDPR, while the AI Act adds training data governance, technical documentation and human oversight, plus a fundamental rights impact assessment for certain deployers of high-risk systems.

Yes, as soon as the processing targets people located in the Union. Article 3 sets two alternative tests: offering goods or services to those people, whether paid for or free, or monitoring their behaviour within the Union. A controller with no EU establishment must then designate a representative in the Union in writing, subject to limited exemptions. Where the servers sit does not change whether the regulation applies: it matters instead for how transfers outside the EU must be framed.

Article 30 sets the minimum content for a controller's record: the identity and contact details of the controller and, where applicable, of the data protection officer, the purposes pursued, the categories of data subjects and of personal data, the categories of recipients, transfers to third countries and the safeguards attached to them, then, where possible, the envisaged time limits for erasure and a general description of the technical and organisational security measures. The record is kept per processing activity rather than per application, and must be made available to the supervisory authority on request.

A spreadsheet gives you a snapshot, never a history. Every processing activity added, every change of processor, every revised retention period creates a parallel version, and the link between an activity, its DPIA, its risks and its measures ends up lost. Dedicated software holds that link, keeps a trace of the decisions taken and flags what is due for review. In Vailor, a project's GDPR obligations are flagged at pre-assessment, and the audit trail stays readable by the DPO and by the supervisory authority alike.