The GDPR programme

The GDPR programme sits under Standards → GDPR, beside the standards, and works like them: steps in phases, each producing a record, on one page with Steps and Clauses tabs.

You switch it on under Organisation → Frameworks, like a standard. It is off until you do: a workspace that handles its wider data-protection work elsewhere is not asked to run it here. Switching it off later hides the programme and keeps every record.

It differs from the standards in three ways:

• It is on every plan. Nothing about it is an upgrade, and it is never behind the frameworks-crosswalk switch.
• Its steps are your GDPR organisation duties. The same rows are listed on Obligations (Source: GDPR, Scope: Organisation). Work one in either place and both show it.
• It is never gated. Its phases — Establish · Map · Protect · Operate, plus Conditional / specialist — are an order of work, and no step waits for another (see Phases and gates).

The GDPR's system duties are not steps of this programme and do not depend on the switch. They are rows on each AI system that processes personal data, generated from the data questions you answer when you register or reclassify the system. If no system is marked as processing personal data, none apply yet; the Overview says so.

During the public beta the GDPR programme is the only one that can be switched on. ISO/IEC 42001, ISO/IEC 27001 and NIST AI RMF are listed, faded, and open with the full launch, planned for late November 2026.