← Back to Compliance
Compliance Framework

GDPR technical measures, in the code.

GDPR Article 25 requires data protection by design and by default, meaning technical measures must be built into systems from the ground up. MergeGuide maps applicable code-level technical measures, detects GDPR-relevant violations as developer code is written, and produces evidence that supports your GDPR technical-measures records. MergeGuide addresses the technical-measures component only; it does not make an organization GDPR-compliant.

The challenge

Where GDPR violations originate

Many GDPR enforcement actions trace back to technical failures in software: inadequate encryption of personal data, missing access controls, logging of personal data to insecure outputs, and vulnerabilities that enable unauthorized access. These are code-level failures, and they are detectable before they reach production.

Article 32 requires "appropriate technical and organisational measures" including encryption, pseudonymization, and ongoing testing. MergeGuide addresses the technical-measures component: detecting violations as code is written, rather than after a breach occurs.

MergeGuide includes policies that map applicable GDPR technical measures, detecting Article 25 and Article 32 violations in code that handles personal data, and producing evidence artifacts that can support your Records of Processing Activities (RoPA). It does not cover the organisational measures GDPR also requires.

Mapped technical measures

GDPR technical-measure coverage

MergeGuide templates map applicable GDPR technical measures at the code level:

Art. 25 Data protection by design Art. 32(1)(a) Pseudonymization & encryption Art. 32(1)(b) Confidentiality, integrity, availability Art. 32(1)(d) Testing technical measures Art. 33 Breach notification readiness Art. 5(1)(f) Security of personal data
Enforcement

How MergeGuide enforces GDPR technical measures

ENC

Encryption enforcement

MergeGuide detects when code handles personal data without encryption, whether in database field definitions, API serializers, file writes, or log statements. Violations are flagged with the specific GDPR article reference so developers understand the regulatory context.

A32

Article 32 evidence

Every evaluation generates evidence that Article 32 technical measures were tested. This evidence can support your Records of Processing Activities and help demonstrate to supervisory authorities that you conduct regular testing and evaluation of your technical measures.

SRC

Breach prevention at source

The highest cost of a GDPR violation is often the breach itself, not the fine. MergeGuide helps prevent the code-level vulnerabilities that enable unauthorized access to personal data, reducing breach risk before it becomes a 72-hour notification obligation.

Evidence

Evidence that supports your technical-measures records

GDPR Article 32(1)(d) calls for a process for regularly testing, assessing, and evaluating the effectiveness of technical measures. MergeGuide evidence artifacts are built to support that requirement.

Each artifact contains

  • Cryptographic commit hash (tamper-evident)
  • UTC timestamp with millisecond precision
  • Actor identity (who triggered evaluation)
  • GDPR article mapping for every technical-measures policy evaluated
  • Pass / fail / exception disposition with justification
  • Cryptographic signature verified on every read

Support for your RoPA

MergeGuide evidence documents that Article 32 technical measures were tested at code-creation time. The artifacts can support your Records of Processing Activities and your demonstration to supervisory authorities that technical measures are regularly tested and evaluated.

  • Maps each evaluation to the applicable GDPR article
  • Accumulates continuously across the development cycle
  • Signed at export: tamper-proof for delivery
  • Covers the technical-measures component; organisational measures are out of scope
Detection engine

GDPR-relevant detection patterns

Selected examples of what MergeGuide catches. These patterns run on every commit, across the languages your team writes in.

GDPR Requirement What MergeGuide Detects Severity
Art. 32: EncryptionPersonal data fields stored without encryption in database schemas and ORMsCritical
Art. 32: EncryptionPersonal data transmitted over HTTP or deprecated TLS protocolsHigh
Art. 32: Access controlHardcoded credentials granting access to systems processing personal dataCritical
Art. 32: Security testingSQL injection patterns that could enable unauthorized access to personal dataCritical
Art. 25: Privacy by designPersonal data written to log files or debug outputHigh
Art. 33: Breach readinessMissing audit logging on endpoints that process personal dataHigh
Art. 25: Data minimizationExcessive personal data fields returned in API responses without filteringMedium

Building software that handles EU personal data?

See how MergeGuide maps GDPR technical requirements at the code layer and generates Article 32 evidence that supports your technical-measures records.

Book a Demo Get Started Free