GDPR Checklist
Deadline: Průběžně
Část C: GDPR Compliance
| # | Aktivita | Reference | Fáze | Popis |
|---|---|---|---|---|
| C1 | Scope & GAP Analýza | Čl. 2, 3 | Příprava | Určení rozsahu zpracování a analýza mezer |
| C1.1 | – Territorial scope | Čl. 3 | Příprava | Zpracování dat EU rezidentů? |
| C1.2 | – Current state assessment | Čl. 5, 24 | Příprava | Audit současného stavu GDPR compliance |
| C1.3 | – GAP identification | Čl. 24 | Příprava | Identifikace mezer vs. GDPR požadavky |
| C2 | Data Mapping (ROPA) | Čl. 30 | Analýza | Records of Processing Activities |
| C2.1 | – Personal Data Categories | Čl. 30(1)(c) | Analýza | Jména, emaily, IP, cookies, behaviorální, health data |
| C2.2 | – Legal Basis | Čl. 6, 9 | Analýza | Consent / Contract / Legal / Legitimate interest |
| C2.3 | – Data Subject Categories | Čl. 30(1)(c) | Analýza | Customers, employees, partners, prospects |
| C2.4 | – Retention Periods | Čl. 5(1)(e), 30(1)(f) | Analýza | Jak dlouho uchovávat? Auto-delete procedury |
| C2.5 | – Data Flow Diagram | Čl. 30 | Analýza | Vizualizace toků osobních údajů |
| C2.6 | – Third-country transfers | Čl. 44-49 | Analýza | Přenosy mimo EU/EEA |
| C3 | Data Processing Agreements (DPA) | Čl. 28 | Governance | Smlouvy se všemi zpracovateli |
| C3.1 | – Controllers vs. Processors | Čl. 4(7,8), 26 | Governance | Audit: Kdo je controller? Kdo processor? |
| C3.2 | – Processor list | Čl. 28(1) | Governance | Seznam všech zpracovatelů |
| C3.3 | – Sub-processor Management | Čl. 28(2,4) | Governance | Kdo jsou sub-processors? Souhlasy? |
| C3.4 | – DPA Templates | Čl. 28(3) | Governance | Standardizované smlouvy (EN, CZ) |
| C3.5 | – SCCs for transfers | Čl. 46(2)(c) | Governance | Standard Contractual Clauses pro non-EU transfers |
| C4 | Privacy by Design & Default | Čl. 25 | Implementace | Ochrana soukromí v návrhu systémů |
| C4.1 | – Privacy by Design principles | Čl. 25(1) | Implementace | Zabudování privacy do návrhu systémů |
| C4.2 | – Privacy by Default | Čl. 25(2) | Implementace | Výchozí nastavení = minimum dat |
| C4.3 | – Data Minimization | Čl. 5(1)(c) | Implementace | Pouze nutná data. Smazání zbytečných sloupců |
| C4.4 | – Pseudonymization | Čl. 4(5), 25 | Implementace | Pro analytics: pseudonymizovat kde možné |
| C4.5 | – Anonymization | GDPR Recital 26 | Implementace | Plná anonymizace kde možné |
| C5 | Technical & Organizational Measures | Čl. 32 | Implementace | Bezpečnost zpracování |
| C5.1 | – Encryption at rest | Čl. 32(1)(a) | Implementace | Šifrování osobních údajů at rest (AES-256) |
| C5.2 | – Encryption in transit | Čl. 32(1)(a) | Implementace | Šifrování při přenosu (TLS 1.3) |
| C5.3 | – Access control | Čl. 32(1)(b) | Implementace | Řízení přístupu k osobním údajům |
| C5.4 | – Confidentiality | Čl. 32(1)(b) | Implementace | Zajištění důvěrnosti |
| C5.5 | – Integrity | Čl. 32(1)(b) | Implementace | Zajištění integrity dat |
| C5.6 | – Availability | Čl. 32(1)(b) | Implementace | Zajištění dostupnosti |
| C5.7 | – Resilience | Čl. 32(1)(b) | Implementace | Odolnost systémů |
| C5.8 | – Restore capability | Čl. 32(1)(c) | Implementace | Schopnost obnovit dostupnost dat |
| C5.9 | – Regular testing | Čl. 32(1)(d) | Testování | Pravidelné testování účinnosti opatření |
| C6 | DPIA (Impact Assessment) | Čl. 35 | Analýza | Data Protection Impact Assessment |
| C6.1 | – DPIA proces definován | Čl. 35(1) | Governance | Kdy a jak provádět DPIA |
| C6.2 | – DPIA template | Čl. 35(7) | Governance | Šablona pro DPIA |
| C6.3 | – DPIA pro high-risk processing | Čl. 35(3) | Analýza | Provedeno pro high-risk zpracování |
| C6.4 | – DPIA pro AI systems | Čl. 35 + AI Act | Analýza | DPIA pro AI zpracovávající osobní údaje |
| C7 | Subject Rights (DSAR) | Čl. 15-22 | Implementace | Práva subjektů údajů |
| C7.1 | – DSAR workflow | Čl. 12 | Implementace | Proces zpracování žádostí subjektů |
| C7.2 | – DSAR email/formulář | Čl. 12(2) | Implementace | Kanál pro přijímání žádostí |
| C7.3 | – Identity verification | Čl. 12(6) | Implementace | Proces ověření identity žadatele |
| C7.4 | – Right to Access | Čl. 15 | Implementace | Workflow: odpovědět do 30 dní |
| C7.5 | – Right to Erasure | Čl. 17 | Implementace | Delete user data včetně backupů |
| C7.6 | – Right to Rectification | Čl. 16 | Implementace | Oprava chyb, audit log |
| C7.7 | – Right to Portability | Čl. 20 | Implementace | Export v CSV/JSON/XML |
| C7.8 | – Right to Restriction | Čl. 18 | Implementace | Omezení zpracování |
| C7.9 | – Right to Object | Čl. 21 | Implementace | Námitka proti zpracování |
| C7.10 | – DSAR register | Čl. 12 | Monitoring | Evidence zpracovaných žádostí |
| C8 | Consent Management | Čl. 7 | Implementace | Správa souhlasů |
| C8.1 | – Cookie Management | Čl. 7, ePrivacy | Implementace | Essential/Functional/Analytics/Marketing cookies |
| C8.2 | – Cookie banner | ePrivacy | Implementace | GDPR-compliant cookie banner |
| C8.3 | – Email Consent Tracking | Čl. 7(1) | Implementace | Double-opt-in workflow |
| C8.4 | – Consent Withdrawal | Čl. 7(3) | Implementace | Procedura odvolání souhlasu |
| C8.5 | – Consent records | Čl. 7(1) | Monitoring | Evidence udělených souhlasů |
| C9 | Privacy Policy & Transparency | Čl. 12-14 | Dokumentace | Informační povinnost |
| C9.1 | – Privacy Policy | Čl. 13, 14 | Dokumentace | Srozumitelná, kompletní, aktuální |
| C9.2 | – GDPR Transparency (Art. 13/14) | Čl. 13, 14 | Dokumentace | 18 items informací pro subjekty |
| C9.3 | – AI Transparency | Čl. 22 + AI Act | Dokumentace | Informace o AI v rozhodování |
| C9.4 | – Layered notices | Čl. 12(1) | Dokumentace | Víceúrovňové informace (shrnutí + detail) |
| C10 | Data Breach Management | Čl. 33, 34 | Incident | Procedura hlášení porušení |
| C10.1 | – Breach detection | Čl. 33 | Incident | Procesy pro detekci porušení |
| C10.2 | – Breach assessment | Čl. 33(1) | Incident | Risk assessment dopadu porušení |
| C10.3 | – ÚOOÚ notification (72h) | Čl. 33 | Incident | Notifikace do 72 hodin |
| C10.4 | – Subject notification | Čl. 34 | Incident | Notifikace subjektů při vysokém riziku |
| C10.5 | – Breach register | Čl. 33(5) | Monitoring | Evidence všech porušení |
| C10.6 | – Notification templates | Čl. 33, 34 | Dokumentace | Šablony pro notifikace (ÚOOÚ, subjekty) |
| C11 | DPO (Data Protection Officer) | Čl. 37-39 | Governance | Pověřenec pro ochranu osobních údajů |
| C11.1 | – DPO jmenován | Čl. 37 | Governance | DPO určen a jmenován |
| C11.2 | – DPO independence | Čl. 38(3) | Governance | Nezávislost DPO zajištěna |
| C11.3 | – DPO Contact Public | Čl. 37(7) | Governance | dpo@firma.cz publikováno na webu |
| C11.4 | – DPO registered with ÚOOÚ | Čl. 37(7) | Governance | Registrace DPO u dozorového úřadu |
| C11.5 | – DPO Responsibilities | Čl. 39 | Governance | Monitoring, audit, education, liaison |
| C12 | Training & Awareness | Čl. 39(1)(b) | Training | Školení zaměstnanců |
| C12.1 | – GDPR training (all staff) | Čl. 39(1)(b) | Training | Základní GDPR školení pro všechny |
| C12.2 | – Role-specific training | Čl. 39(1)(b) | Training | Specializované školení (HR, Marketing, IT) |
| C12.3 | – Training records | Čl. 24(1) | Monitoring | Evidence absolvovaných školení |
| C12.4 | – Awareness program | Čl. 39(1)(b) | Training | Průběžné zvyšování povědomí |
Kritická cesta
- C2 Data Mapping (ROPA) → dokončit do 31.1.2026
- C7.4-C7.5 DSAR Access + Erasure → dokončit do 28.2.2026
- C10 Breach Management → dokončit do 28.2.2026
- C3 DPA se všemi vendors → dokončit do 31.3.2026
- C5 Technical Measures → dokončit do 31.3.2026
Implementační fáze
%3btext-align:center%3b%7d%23mermaid-0 .edgeLabel p%7bbackground-color:rgba(232%2c232%2c232%2c 0.8)%3b%7d%23mermaid-0 .edgeLabel rect%7bopacity:0.5%3bbackground-color:rgba(232%2c232%2c232%2c 0.8)%3bfill:rgba(232%2c232%2c232%2c 0.8)%3b%7d%23mermaid-0 .labelBkg%7bbackground-color:rgba(232%2c 232%2c 232%2c 0.5)%3b%7d%23mermaid-0 .cluster rect%7bfill:%23ffffde%3bstroke:%23aaaa33%3bstroke-width:1px%3b%7d%23mermaid-0 .cluster text%7bfill:%23333%3b%7d%23mermaid-0 .cluster span%7bcolor:%23333%3b%7d%23mermaid-0 div.mermaidTooltip%7bposition:absolute%3btext-align:center%3bmax-width:200px%3bpadding:2px%3bfont-family:arial%2csans-serif%3bfont-size:12px%3bbackground:hsl(80%2c 100%25%2c 96.2745098039%25)%3bborder:1px solid %23aaaa33%3bborder-radius:2px%3bpointer-events:none%3bz-index:100%3b%7d%23mermaid-0 .flowchartTitleText%7btext-anchor:middle%3bfont-size:18px%3bfill:%23333%3b%7d%23mermaid-0 rect.text%7bfill:none%3bstroke-width:0%3b%7d%23mermaid-0 .icon-shape%2c%23mermaid-0 .image-shape%7bbackground-color:rgba(232%2c232%2c232%2c 0.8)%3btext-align:center%3b%7d%23mermaid-0 .icon-shape p%2c%23mermaid-0 .image-shape p%7bbackground-color:rgba(232%2c232%2c232%2c 0.8)%3bpadding:2px%3b%7d%23mermaid-0 .icon-shape .label rect%2c%23mermaid-0 .image-shape .label rect%7bopacity:0.5%3bbackground-color:rgba(232%2c232%2c232%2c 0.8)%3bfill:rgba(232%2c232%2c232%2c 0.8)%3b%7d%23mermaid-0 .label-icon%7bdisplay:inline-block%3bheight:1em%3boverflow:visible%3bvertical-align:-0.125em%3b%7d%23mermaid-0 .node .label-icon path%7bfill:currentColor%3bstroke:revert%3bstroke-width:revert%3b%7d%23mermaid-0 :root%7b--mermaid-font-family:arial%2csans-serif%3b%7d%3c/style%3e%3cg%3e%3cmarker id='mermaid-0_flowchart-v2-pointEnd' class='marker flowchart-v2' viewBox='0 0 10 10' refX='5' refY='5' markerUnits='userSpaceOnUse' markerWidth='8' markerHeight='8' orient='auto'%3e%3cpath d='M 0 0 L 10 5 L 0 10 z' class='arrowMarkerPath' style='stroke-width: 1%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cmarker id='mermaid-0_flowchart-v2-pointStart' class='marker flowchart-v2' viewBox='0 0 10 10' refX='4.5' refY='5' markerUnits='userSpaceOnUse' markerWidth='8' markerHeight='8' orient='auto'%3e%3cpath d='M 0 5 L 10 10 L 10 0 z' class='arrowMarkerPath' style='stroke-width: 1%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cmarker id='mermaid-0_flowchart-v2-circleEnd' class='marker flowchart-v2' viewBox='0 0 10 10' refX='11' refY='5' markerUnits='userSpaceOnUse' markerWidth='11' markerHeight='11' orient='auto'%3e%3ccircle cx='5' cy='5' r='5' class='arrowMarkerPath' style='stroke-width: 1%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cmarker id='mermaid-0_flowchart-v2-circleStart' class='marker flowchart-v2' viewBox='0 0 10 10' refX='-1' refY='5' markerUnits='userSpaceOnUse' markerWidth='11' markerHeight='11' orient='auto'%3e%3ccircle cx='5' cy='5' r='5' class='arrowMarkerPath' style='stroke-width: 1%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cmarker id='mermaid-0_flowchart-v2-crossEnd' class='marker cross flowchart-v2' viewBox='0 0 11 11' refX='12' refY='5.2' markerUnits='userSpaceOnUse' markerWidth='11' markerHeight='11' orient='auto'%3e%3cpath d='M 1%2c1 l 9%2c9 M 10%2c1 l -9%2c9' class='arrowMarkerPath' style='stroke-width: 2%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cmarker id='mermaid-0_flowchart-v2-crossStart' class='marker cross flowchart-v2' viewBox='0 0 11 11' refX='-1' refY='5.2' markerUnits='userSpaceOnUse' markerWidth='11' markerHeight='11' orient='auto'%3e%3cpath d='M 1%2c1 l 9%2c9 M 10%2c1 l -9%2c9' class='arrowMarkerPath' style='stroke-width: 2%3b stroke-dasharray: 1%2c 0%3b'/%3e%3c/marker%3e%3cg class='root'%3e%3cg class='clusters'/%3e%3cg class='edgePaths'%3e%3cpath d='M175.5%2c340L175.5%2c344.167C175.5%2c348.333%2c175.5%2c356.667%2c175.5%2c364.333C175.5%2c372%2c175.5%2c379%2c175.5%2c382.5L175.5%2c386' id='L_F1_F2_0' class='edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid flowchart-link' style='%3b' data-edge='true' data-et='edge' data-id='L_F1_F2_0' data-points='W3sieCI6MTc1LjUsInkiOjM0MH0seyJ4IjoxNzUuNSwieSI6MzY1fSx7IngiOjE3NS41LCJ5IjozOTB9XQ==' marker-end='url(%23mermaid-0_flowchart-v2-pointEnd)'/%3e%3cpath d='M175.5%2c770L175.5%2c774.167C175.5%2c778.333%2c175.5%2c786.667%2c175.5%2c794.333C175.5%2c802%2c175.5%2c809%2c175.5%2c812.5L175.5%2c816' id='L_F2_F3_0' class='edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid flowchart-link' style='%3b' data-edge='true' data-et='edge' data-id='L_F2_F3_0' data-points='W3sieCI6MTc1LjUsInkiOjc3MH0seyJ4IjoxNzUuNSwieSI6Nzk1fSx7IngiOjE3NS41LCJ5Ijo4MjB9XQ==' marker-end='url(%23mermaid-0_flowchart-v2-pointEnd)'/%3e%3cpath d='M175.5%2c1352L175.5%2c1356.167C175.5%2c1360.333%2c175.5%2c1368.667%2c175.5%2c1376.333C175.5%2c1384%2c175.5%2c1391%2c175.5%2c1394.5L175.5%2c1398' id='L_F3_F4_0' class='edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid flowchart-link' style='%3b' data-edge='true' data-et='edge' data-id='L_F3_F4_0' data-points='W3sieCI6MTc1LjUsInkiOjEzNTJ9LHsieCI6MTc1LjUsInkiOjEzNzd9LHsieCI6MTc1LjUsInkiOjE0MDJ9XQ==' marker-end='url(%23mermaid-0_flowchart-v2-pointEnd)'/%3e%3cpath d='M175.5%2c1550L175.5%2c1554.167C175.5%2c1558.333%2c175.5%2c1566.667%2c175.5%2c1574.333C175.5%2c1582%2c175.5%2c1589%2c175.5%2c1592.5L175.5%2c1596' id='L_F4_F5_0' class='edge-thickness-normal edge-pattern-solid edge-thickness-normal edge-pattern-solid flowchart-link' style='%3b' data-edge='true' data-et='edge' data-id='L_F4_F5_0' data-points='W3sieCI6MTc1LjUsInkiOjE1NTB9LHsieCI6MTc1LjUsInkiOjE1NzV9LHsieCI6MTc1LjUsInkiOjE2MDB9XQ==' marker-end='url(%23mermaid-0_flowchart-v2-pointEnd)'/%3e%3c/g%3e%3cg class='edgeLabels'%3e%3cg class='edgeLabel'%3e%3cg class='label' data-id='L_F1_F2_0' transform='translate(0%2c 0)'%3e%3cforeignObject width='0' height='0'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' class='labelBkg' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='edgeLabel'%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='edgeLabel'%3e%3cg class='label' data-id='L_F2_F3_0' transform='translate(0%2c 0)'%3e%3cforeignObject width='0' height='0'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' class='labelBkg' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='edgeLabel'%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='edgeLabel'%3e%3cg class='label' data-id='L_F3_F4_0' transform='translate(0%2c 0)'%3e%3cforeignObject width='0' height='0'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' class='labelBkg' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='edgeLabel'%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='edgeLabel'%3e%3cg class='label' data-id='L_F4_F5_0' transform='translate(0%2c 0)'%3e%3cforeignObject width='0' height='0'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' class='labelBkg' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='edgeLabel'%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='nodes'%3e%3cg class='root' transform='translate(3.6484375%2c 1592)'%3e%3cg class='clusters'%3e%3cg class='cluster' id='F5' data-look='classic'%3e%3crect style='' x='8' y='8' width='327.703125' height='124'/%3e%3cg class='cluster-label' transform='translate(55.515625%2c 8)'%3e%3cforeignObject width='232.671875' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eF%c3%81ZE 5: TRAINING %e2%80%94 Pr%c5%afb%c4%9b%c5%ben%c4%9b%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='edgePaths'/%3e%3cg class='edgeLabels'/%3e%3cg class='nodes'%3e%3cg class='node default' id='flowchart-C12-11' transform='translate(171.8515625%2c 70)'%3e%3crect class='basic label-container' style='' x='-126.3515625' y='-27' width='252.703125' height='54'/%3e%3cg class='label' style='' transform='translate(-96.3515625%2c -12)'%3e%3crect/%3e%3cforeignObject width='192.703125' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eC12: Training %26amp%3b Awareness%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='root' transform='translate(0%2c 1394)'%3e%3cg class='clusters'%3e%3cg class='cluster' id='F4' data-look='classic'%3e%3crect style='' x='8' y='8' width='335' height='148'/%3e%3cg class='cluster-label' transform='translate(60.796875%2c 8)'%3e%3cforeignObject width='229.40625' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eF%c3%81ZE 4: ANAL%c3%9dZA %e2%80%94 M%c4%9bs%c3%adc 3-5%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='edgePaths'/%3e%3cg class='edgeLabels'/%3e%3cg class='nodes'%3e%3cg class='node default' id='flowchart-C6-10' transform='translate(175.5%2c 82)'%3e%3crect class='basic label-container' style='' x='-130' y='-39' width='260' height='78'/%3e%3cg class='label' style='' transform='translate(-100%2c -24)'%3e%3crect/%3e%3cforeignObject width='200' height='48'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table%3b white-space: break-spaces%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b width: 200px%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eC6: DPIA %e2%80%94 Impact Assessment%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='root' transform='translate(0%2c 812)'%3e%3cg class='clusters'%3e%3cg class='cluster' id='F3' data-look='classic'%3e%3crect style='' x='8' y='8' width='335' height='532'/%3e%3cg class='cluster-label' transform='translate(33.84375%2c 8)'%3e%3cforeignObject width='283.3125' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eF%c3%81ZE 3: IMPLEMENTACE %e2%80%94 M%c4%9bs%c3%adc 2-4%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='edgePaths'/%3e%3cg class='edgeLabels'/%3e%3cg class='nodes'%3e%3cg class='node default' id='flowchart-C4-6' transform='translate(175.5%2c 82)'%3e%3crect class='basic label-container' style='' x='-130' y='-39' width='260' height='78'/%3e%3cg class='label' style='' transform='translate(-100%2c -24)'%3e%3crect/%3e%3cforeignObject width='200' height='48'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table%3b white-space: break-spaces%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b width: 200px%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eC4: Privacy by Design %26amp%3b Default%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-C5-7' transform='translate(175.5%2c 210)'%3e%3crect class='basic label-container' style='' x='-130' y='-39' width='260' height='78'/%3e%3cg class='label' style='' transform='translate(-100%2c -24)'%3e%3crect/%3e%3cforeignObject width='200' height='48'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table%3b white-space: break-spaces%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b width: 200px%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eC5: Technical %26amp%3b Organizational Measures%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-C7-8' transform='translate(175.5%2c 338)'%3e%3crect class='basic label-container' style='' x='-130' y='-39' width='260' height='78'/%3e%3cg class='label' style='' transform='translate(-100%2c -24)'%3e%3crect/%3e%3cforeignObject width='200' height='48'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table%3b white-space: break-spaces%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b width: 200px%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eC7: Subject Rights %e2%80%94 DSAR%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-C10-9' transform='translate(175.5%2c 466)'%3e%3crect class='basic label-container' style='' x='-130' y='-39' width='260' height='78'/%3e%3cg class='label' style='' transform='translate(-100%2c -24)'%3e%3crect/%3e%3cforeignObject width='200' height='48'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table%3b white-space: break-spaces%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b width: 200px%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eC10: Data Breach Management%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='root' transform='translate(0%2c 382)'%3e%3cg class='clusters'%3e%3cg class='cluster' id='F2' data-look='classic'%3e%3crect style='' x='8' y='8' width='335' height='380'/%3e%3cg class='cluster-label' transform='translate(39.46875%2c 8)'%3e%3cforeignObject width='272.0625' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eF%c3%81ZE 2: GOVERNANCE %e2%80%94 M%c4%9bs%c3%adc 2-3%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='edgePaths'/%3e%3cg class='edgeLabels'/%3e%3cg class='nodes'%3e%3cg class='node default' id='flowchart-C3-3' transform='translate(175.5%2c 82)'%3e%3crect class='basic label-container' style='' x='-130' y='-39' width='260' height='78'/%3e%3cg class='label' style='' transform='translate(-100%2c -24)'%3e%3crect/%3e%3cforeignObject width='200' height='48'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table%3b white-space: break-spaces%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b width: 200px%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eC3: Data Processing Agreements%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-C8-4' transform='translate(175.5%2c 198)'%3e%3crect class='basic label-container' style='' x='-123.390625' y='-27' width='246.78125' height='54'/%3e%3cg class='label' style='' transform='translate(-93.390625%2c -12)'%3e%3crect/%3e%3cforeignObject width='186.78125' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eC8: Consent Management%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-C9-5' transform='translate(175.5%2c 314)'%3e%3crect class='basic label-container' style='' x='-130' y='-39' width='260' height='78'/%3e%3cg class='label' style='' transform='translate(-100%2c -24)'%3e%3crect/%3e%3cforeignObject width='200' height='48'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table%3b white-space: break-spaces%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b width: 200px%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eC9: Privacy Policy %26amp%3b Transparency%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='root' transform='translate(0.9921875%2c 0)'%3e%3cg class='clusters'%3e%3cg class='cluster' id='F1' data-look='classic'%3e%3crect style='' x='8' y='8' width='333.015625' height='332'/%3e%3cg class='cluster-label' transform='translate(56.546875%2c 8)'%3e%3cforeignObject width='235.921875' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eF%c3%81ZE 1: P%c5%98%c3%8dPRAVA %e2%80%94 M%c4%9bs%c3%adc 1-2%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3cg class='edgePaths'/%3e%3cg class='edgeLabels'/%3e%3cg class='nodes'%3e%3cg class='node default' id='flowchart-C1-0' transform='translate(174.5078125%2c 70)'%3e%3crect class='basic label-container' style='' x='-124.1328125' y='-27' width='248.265625' height='54'/%3e%3cg class='label' style='' transform='translate(-94.1328125%2c -12)'%3e%3crect/%3e%3cforeignObject width='188.265625' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eC1: Scope %26amp%3b GAP Anal%c3%bdza%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-C2-1' transform='translate(174.5078125%2c 174)'%3e%3crect class='basic label-container' style='' x='-129.0078125' y='-27' width='258.015625' height='54'/%3e%3cg class='label' style='' transform='translate(-99.0078125%2c -12)'%3e%3crect/%3e%3cforeignObject width='198.015625' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eC2: Data Mapping %e2%80%94 ROPA%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3cg class='node default' id='flowchart-C11-2' transform='translate(174.5078125%2c 278)'%3e%3crect class='basic label-container' style='' x='-88.9921875' y='-27' width='177.984375' height='54'/%3e%3cg class='label' style='' transform='translate(-58.9921875%2c -12)'%3e%3crect/%3e%3cforeignObject width='117.984375' height='24'%3e%3cdiv xmlns='http://www.w3.org/1999/xhtml' style='display: table-cell%3b white-space: nowrap%3b line-height: 1.5%3b max-width: 200px%3b text-align: center%3b'%3e%3cspan class='nodeLabel'%3e%3cp%3eC11: DPO Setup%3c/p%3e%3c/span%3e%3c/div%3e%3c/foreignObject%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/g%3e%3c/svg%3e)