GDPR Readiness: 20 tehničkih kontrola pre audita

Zašto tehnička priprema nije opcija

GDPR član 32 zahteva "prikladne tehničke i organizacione mere" za zaštitu ličnih podataka. Ovo nije fraza — revizori i inspektori imaju konkretne checkliste. Kompanije koje prođu GDPR audit bez pripreme često otkrivaju da su propustile trivijalne tehničke detalje koji koštaju više od same sertifikacije.

Dobra vest: oko 90% tehničkih GDPR zahteva može se automatski proveriti. Ostatak su organizacione mere koje vi dokumentujete. Ova lista pokriva tehničku stranu.

Blok 1: Sigurnost prenosa podataka (Art. 32)

1. HTTPS na svim stranicama

Sav saobraćaj mora biti enkriptovan. Proverite da li imate automatski redirect sa HTTP na HTTPS, da li je HSTS header postavljen (Strict-Transport-Security: max-age=31536000; includeSubDomains), i da li su svi resursi (slike, skripte, fontovi) učitani preko HTTPS.

2. Jaka TLS konfiguracija

TLS 1.0 i 1.1 su zastareli i moraju biti onemogućeni. Minimalni standard je TLS 1.2, preporučeno TLS 1.3. Slabe cipher suite-ove (RC4, DES, 3DES) eliminirajte. Alat za proveru: testssl.sh ili SSL Labs.

3. Validni SSL sertifikat

Istekli ili self-signed sertifikat je automatski fail. Koristite Let's Encrypt (besplatno) ili komercijalni CA. Podesite monitoring isteka sertifikata minimum 30 dana unapred.

Blok 2: Autentifikacija i sesije (Art. 25, 32)

4. Jaka politika lozinki

Minimum 12 karaktera, kombinacija tipova. Još važnije: proverite kompromitovane lozinke nasuprot Have I Been Pwned baze pri registraciji. NIST SP 800-63B je referentni dokument.

5. Multi-factor autentifikacija za privilegovane naloge

MFA je obavezna za admin pristup, pristup bazama podataka i sisteme koji obrađuju veliku količinu ličnih podataka. Revizori posebno proveravaju ovu tačku.

6. Bezbedne session cookie konfiguracije

Svaki session cookie mora imati: HttpOnly (JavaScript ne može čitati), Secure (samo HTTPS), SameSite=Lax (CSRF zaštita). Session timeout: maksimalno 30 minuta neaktivnosti za sisteme sa osetljivim podacima.

7. Brute force zaštita

Rate limiting na login endpoint-u: maksimalno 5 neuspešnih pokušaja, pa CAPTCHA ili privremena blokada. Logujte svaki neuspeli pokušaj sa IP adresom i timestamp-om.

Blok 3: Cookie consent i transparentnost (Art. 6, 7, 13)

8. Pravi cookie consent

Consent mora biti: specifičan (ne "prihvatam sve"), informisan (šta se prikuplja), dobrovoljan (ne pre nego što se dâ), i povlačiv u svakom trenutku. Dark patterns (siv "odbij" dugme, pre-checked checkbox) su direktno kršenje.

9. Tehnička realizacija consent-a

Analytics i marketing cookie-ji se ne smeju učitati pre consent-a. Proverite da li GTM tags fire pre ili posle consent-a. Cookie audit: popišite sve cookie-je koje vaš sajt postavlja i kategorizujte ih (neophodni / analitički / marketinški).

10. Politika privatnosti — tehnička usklađenost

Link ka politici mora biti vidljiv pre prikupljanja podataka (login forma, contact forma, newsletter). Politika mora navesti pravni osnov za svaki tip obrade (Art. 13), rok čuvanja podataka i subprocesore.

Blok 4: Pravo na brisanje i portabilnost (Art. 17, 20)

11. Funkcionalnost brisanja naloga

Korisnik mora moći da traži brisanje svih ličnih podataka. Proverite: da li brisanje zaista uklanja podatke iz svih baza (uključujući backup sisteme), logove i analytics. Obaveza odgovora: 30 dana.

12. Export ličnih podataka

Pravo na portabilnost (Art. 20) zahteva da korisniku date sve podatke koje ste o njemu prikupili, u mašinski čitljivom formatu (JSON ili CSV). Implementirajte "Export my data" funkcionalnost.

Blok 5: Logovanje i monitoring (Art. 32)

13. Audit logovi pristupa ličnim podacima

Ko je, kada i čemu pristupio. Logovi moraju biti zaštićeni od izmene (write-once storage ili SIEM). Revizori traže logove za minimalno 12 meseci.

14. Detection neovlašćenog pristupa

Alerting na neobičan pristup: neočekivane IP adrese za admin pristup, masovni export podataka, pristup u neuobičajeno vreme. Bez monitoringa, ne možete ispuniti obavezu notifikacije u roku 72 sata (Art. 33).

15. Data breach procedure

Imate 72 sata od saznanja o povredi da notifikujete nadzorno telo. Morate imati pisani procedure koji definiše: ko odlučuje, ko notifikuje, koji kanal. Ovo je organizaciona mera ali revizori pitaju i za tehničku stranu detekcije.

Blok 6: Sigurnost aplikacije (Art. 25, 32)

16. Zaštita od OWASP Top 10 ranjivosti

SQL injection koji izlaze podatke klijenata, XSS koji krade session token-e, IDOR koji izlaže tuđe podatke — sve su direktna GDPR kršenja jer dovode do neovlašćenog pristupa ličnim podacima. Redovni vulnerability assessment je tehnička mera koja se dokumentuje.

17. Security headers

CSP sprečava XSS, X-Frame-Options sprečava clickjacking, HSTS forsira HTTPS. Ovi headeri su besplatni i direktno adresiraju tehničke mere iz Art. 32. Proverite sve na securityheaders.com.

18. Enkripcija podataka u bazi

Lozinke moraju biti hešovane (bcrypt, Argon2 — ne MD5 ili SHA1). Osetljivi podaci (JMBG, broj pasoša, zdravstveni podaci) moraju biti enkriptovani i u bazi, ne samo u prenosu.

Blok 7: Subprocesori i treće strane (Art. 28)

19. Popis subprocesora

Svaka treća strana kojoj šaljete lične podatke je subprocesor: Stripe, Mailchimp, Google Analytics, AWS, Intercom. Za svaku morate imati Data Processing Agreement (DPA). Objavite listu na sajtu.

20. Prenos podataka izvan EU (Art. 46)

Ako koristite US cloud provajdere koji nemaju EU Data Center (ili niste izabrali EU region), prenos podataka građana EU izvan EU zahteva dodatne garancije. Proverite lokaciju podataka za svaki SaaS alat koji koristite.

Shieldome Scout Compliance Readiness paket pokriva tehničke kontrole (1–18) automatski i kroz manuelni assessment, uz gap analysis izveštaj koji možete pokazati revizorima. Organizacione mere (19–20) pokrivate vi — mi vam dajemo checklist i template DPA dokumenata. Zatražite ponudu →

Proverite bezbednost vašeg sajta

Profesionalna procena ranjivosti. OWASP Top 10, dark web monitoring, PDF izveštaj za 2–3 radna dana.

Zatražite procenu →

← Blog

Why Technical Preparation Isn't Optional

GDPR Article 32 requires "appropriate technical and organizational measures" to protect personal data. This isn't a vague phrase — auditors and supervisory authorities have concrete checklists. Companies that go through a GDPR audit unprepared often discover they've missed trivial technical details that cost more than the certification itself.

The good news: about 90% of technical GDPR requirements can be verified automatically. The rest are organizational measures you document. This list covers the technical side.

Block 1: Data Transfer Security (Art. 32)

1. HTTPS on All Pages

All traffic must be encrypted. Check for automatic HTTP-to-HTTPS redirect, HSTS header presence (Strict-Transport-Security: max-age=31536000; includeSubDomains), and whether all resources (images, scripts, fonts) load over HTTPS.

2. Strong TLS Configuration

TLS 1.0 and 1.1 are deprecated and must be disabled. Minimum standard is TLS 1.2, recommended TLS 1.3. Eliminate weak cipher suites (RC4, DES, 3DES). Testing tools: testssl.sh or SSL Labs.

3. Valid SSL Certificate

An expired or self-signed certificate is an automatic fail. Use Let's Encrypt (free) or a commercial CA. Set up certificate expiry monitoring at least 30 days in advance.

Block 2: Authentication and Sessions (Art. 25, 32)

4. Strong Password Policy

Minimum 12 characters, mixed character types. More importantly: check against compromised passwords using the Have I Been Pwned database at registration. NIST SP 800-63B is the reference document.

5. Multi-Factor Authentication for Privileged Accounts

MFA is mandatory for admin access, database access, and systems processing large volumes of personal data. Auditors specifically check this point.

6. Secure Session Cookie Configuration

Every session cookie must have: HttpOnly (JavaScript can't read), Secure (HTTPS only), SameSite=Lax (CSRF protection). Session timeout: maximum 30 minutes of inactivity for systems handling sensitive data.

7. Brute Force Protection

Rate limiting on the login endpoint: maximum 5 failed attempts, then CAPTCHA or temporary block. Log every failed attempt with IP address and timestamp.

Block 3: Cookie Consent and Transparency (Art. 6, 7, 13)

8. Proper Cookie Consent

Consent must be: specific (not "accept all"), informed (what is collected), voluntary (not required before giving), and withdrawable at any time. Dark patterns (grayed "reject" button, pre-checked checkbox) are direct violations.

9. Technical Implementation of Consent

Analytics and marketing cookies must not load before consent. Check whether GTM tags fire before or after consent. Cookie audit: list all cookies your site sets and categorize them (necessary / analytics / marketing).

10. Privacy Policy — Technical Compliance

A link to the policy must be visible before data collection (login form, contact form, newsletter). The policy must state the legal basis for each type of processing (Art. 13), data retention period, and subprocessors.

Block 4: Right to Erasure and Portability (Art. 17, 20)

11. Account Deletion Functionality

Users must be able to request deletion of all personal data. Check: does deletion actually remove data from all databases (including backup systems), logs, and analytics. Response obligation: 30 days.

12. Personal Data Export

The right to portability (Art. 20) requires providing all collected data to the user in machine-readable format (JSON or CSV). Implement a "Export my data" feature.

Block 5: Logging and Monitoring (Art. 32)

13. Audit Logs for Personal Data Access

Who accessed what, and when. Logs must be tamper-proof (write-once storage or SIEM). Auditors request logs for at least 12 months.

14. Unauthorized Access Detection

Alerting on unusual access: unexpected IP addresses for admin access, bulk data export, access at unusual times. Without monitoring, you cannot meet the 72-hour breach notification obligation (Art. 33).

15. Data Breach Procedure

You have 72 hours from discovering a breach to notify the supervisory authority. You must have a written procedure defining: who decides, who notifies, which channel. Auditors ask about the technical detection side too.

Block 6: Application Security (Art. 25, 32)

16. Protection Against OWASP Top 10 Vulnerabilities

SQL injection leaking client data, XSS stealing session tokens, IDOR exposing other users' data — these are all direct GDPR violations as they lead to unauthorized access to personal data. Regular vulnerability assessment is a technical measure to document.

17. Security Headers

CSP prevents XSS, X-Frame-Options prevents clickjacking, HSTS enforces HTTPS. These headers are free and directly address the technical measures in Art. 32. Check all at securityheaders.com.

18. Data Encryption in Database

Passwords must be hashed (bcrypt, Argon2 — not MD5 or SHA1). Sensitive data (national ID numbers, passport numbers, health data) must be encrypted at rest, not just in transit.

Block 7: Subprocessors and Third Parties (Art. 28)

19. Subprocessor Inventory

Every third party you send personal data to is a subprocessor: Stripe, Mailchimp, Google Analytics, AWS, Intercom. You need a Data Processing Agreement (DPA) for each. Publish the list on your site.

20. Data Transfers Outside the EU (Art. 46)

If you use US cloud providers without an EU Data Center (or haven't selected EU regions), transferring EU citizens' data outside the EU requires additional safeguards. Check the data location for every SaaS tool you use.

Shieldome Scout's Compliance Readiness package covers technical controls (1–18) automatically and through manual assessment, with a gap analysis report you can show auditors. Organizational measures (19–20) are covered by you — we provide the checklist and DPA document templates. Request a quote →

Check Your Website Security

Professional vulnerability assessment. OWASP Top 10, dark web monitoring, PDF report in 2–3 business days.

Request Assessment →