GDPR

Our role

Sentinel Shield acts as a data processor for the personal data you submit to the platform. You, the customer, remain the data controller and are responsible for determining the purposes and means of processing. Our processing is governed by our Data Processing Agreement (DPA), available to all customers on request.

How we help you comply

The platform is designed to support your GDPR compliance programme across several key articles:

• Article 5 — Principles: Data minimisation, purpose limitation, and storage limitation are built into our records of processing activities (ROPA) and retention schedule modules.
• Article 6 — Lawful basis: Each processing activity in your ROPA requires a documented legal basis, with consent tracking for consent-based processing.
• Articles 15–22 — Data subject rights: The DSAR module helps you manage access, rectification, erasure, and portability requests within the one-month statutory deadline, with identity verification workflows and SLA countdowns.
• Article 25 — Data protection by design: Our DPIA module guides you through privacy impact assessments for new AI systems and processing activities.
• Article 28 — Processors: The vendor register tracks your sub-processors, DPA signatures, and international transfer mechanisms (SCCs, adequacy, BCRs).
• Article 30 — Records of processing: The ROPA register provides a structured, exportable record of all processing activities, as required by Article 30.
• Articles 33–34 — Breach notification: The incident module includes 72-hour breach notification countdowns to help you meet the supervisory authority notification deadline.
• Article 35 — DPIAs: Structured DPIA templates with risk scoring, likelihood/impact assessment, and residual risk tracking.
• Articles 37–39 — DPO: DPO contact details are captured during onboarding and surfaced across the platform and in generated reports.

International transfers

For transfers of personal data outside the UK/EEA, we rely on Standard Contractual Clauses (SCCs) and, where applicable, adequacy decisions. The vendor register helps you document the transfer mechanism for each sub-processor you use.

Data subject requests

If you are a data subject whose personal data has been submitted to the platform by a Sentinel Shield customer, please direct your request to the organisation that submitted your data — they are the data controller and responsible for responding. We support our customers in fulfilling such requests through the DSAR module.

Your responsibilities

While Sentinel Shield provides the tools to support GDPR compliance, you remain responsible for the accuracy of the data you enter, the lawfulness of your processing, and the decisions you make based on the platform's outputs. Our tools support but do not replace your own compliance judgement.

Changes to this page

We may update this page as our platform evolves and as GDPR guidance changes. Material changes will be communicated to customers through in-app notifications.