Following the GDPR, companies and organisations must guarantee adequate information security for the personal data registers they collect. Merely stating compliance with laws and regulations is not sufficient to fulfil the obligations of the General Data Protection Regulation. Controllers and processors must be able to clearly demonstrate compliance with the rules. Clearly described and documented processes for processing personal data help to build trust in the company’s operations.