GDPR: what it requires for data integrity, and how to prove it
Short answer
The GDPR has applied across the European Union since May 2018. It requires personal data to be processed with appropriate security (Article 5(1)(f)), appropriate technical measures to ensure data integrity (Article 32) and breach notification within 72 hours (Article 33). ROOTKey helps prove the integrity, authenticity and traceability of personal data - privacy by design, immutable processing records and breach notification backed by cryptographic evidence.
- Maximum fine
- €20Mor 4% of global annual turnover
- Notification deadline
- 72hafter detecting a personal data breach
- Data subject rights
- 8access, rectification, erasure and more
- In force since
- May 2018applicable across the European Union
Article by article: the requirement and the proof
Article 5(1)(f) of the GDPR requires personal data to be processed with appropriate security. Article 32 requires appropriate technical measures to ensure data integrity. Article 33 requires breach notification within 72 hours. This is how each requirement maps onto ROOTKey.
| Article | Requirement | ROOTKey | Status |
|---|---|---|---|
| 5(1)(f)Integrity and confidentiality | Personal data must be processed in a way that ensures its security, including protection against unauthorised processing and accidental loss. | Every data item receives an immutable cryptographic proof. Any unauthorised change is detectable instantly - integrity verifiable in real time. | Covered |
| 25Data protection by design | From the design stage of a system, appropriate technical measures must be implemented to meet the data-protection principles. | Native cryptographic verification across the platform - privacy is built into the architecture, not added afterwards. | Covered |
| 30Records of processing | Keep written records of all personal-data processing activities, including purposes, categories and retention periods. | An immutable record of all processing operations with a hash verifiable per version - an auditable history that cannot be altered retroactively. | Covered |
| 32Security of processing | GDPR Article 32 requires appropriate technical measures to ensure data integrity. | ROOTKey provides continuous integrity verification and an immutable audit trail that demonstrates compliance with this requirement. | Covered |
| 33Breach notification | Notify the supervisory authority within 72 hours of becoming aware of a personal data breach, unless it is unlikely to result in a risk. | Immutable timestamped logs and structured export - verifiable evidence of the moment the breach was detected, ready for notification in minutes. Your report states what changed, who, when and where. | Covered |
| 35Impact assessment (DPIA) | Carry out an impact assessment before starting processing that is likely to result in a high risk to the rights of data subjects. | Immutable documentation of every mitigation measure implemented, with cryptographic proof of when it was applied - robust support for the DPIA. | Covered |
Article 17 (right to erasure): partial coverage.
Official text: Regulation (EU) 2016/679 on EUR-Lex.
GDPR in five minutes
A plain-language walkthrough of the regulation: what it requires, the fines, and where data integrity fits in.
NIS2, DORA and GDPR are explained in the same format in the Compliance playlist on our YouTube channel.
How ROOTKey fits: on top of your infrastructure, not instead of it
ROOTKey doesn't replace existing systems. It adds a layer of cryptographic verification via API - no migrations, no vendor lock-in.
- Verifiable data integrity
- Every piece of personal data gets an independent cryptographic proof; auditors verify it without accessing the content.
- Immutable processing records
- An auditable history of processing operations, with a cryptographic hash per version.
- Timestamped notification
- An immutable timestamp of the moment of detection, so you can notify the authority within 72 hours with evidence.
Any file, one kind of proof
PDF, images, Word, Excel, PowerPoint, tables and databases: whatever the file, ROOTKey compares it with its sealed original and shows only what was altered.
- Deployment
- SaaS · Private cloud · On-premise
- Connectors
- SharePoint · OneDrive · Amazon S3 · Cloudflare R2 · tables and databases · REST API and webhooks
Integration: live in days, not months
Documented REST API and webhooks, dedicated enterprise support. ROOTKey adapts to your infrastructure - not the other way round.
Integrate via API
Documented REST API and webhooks. Live in days, without replacing existing infrastructure.
Automatic proofs
Every processing operation generates an immutable, auditable cryptographic proof, with minimal operational effort.
Instant reporting
A real-time compliance dashboard and evidence exports for regulators in seconds.
Frequently asked questions
How does ROOTKey support GDPR Article 5 data integrity?
GDPR Article 5(1)(f) requires personal data to be processed with appropriate security. ROOTKey's cryptographic hash anchoring proves whether personal data has been modified or altered after processing.
Does ROOTKey help with GDPR Article 32?
Yes. GDPR Article 32 requires appropriate technical measures to ensure data integrity. ROOTKey provides continuous integrity verification and an immutable audit trail that demonstrates compliance with this requirement.
How does ROOTKey support GDPR Article 33 breach notification?
Article 33 requires breach notification within 72 hours. ROOTKey's tamper-detection alerts provide the exact timestamp of when integrity was compromised, supplying the evidence needed for an accurate notification.
Does using ROOTKey constitute data processing under GDPR?
It depends on the deployment model. On the SaaS platform, ROOTKey hosts the protected data in the EU and acts as a processor under a Data Processing Agreement. With a custom deployment where the data stays in your infrastructure, ROOTKey handles only fingerprints and metadata, never the files. A fingerprint is one-way and does not contain the data, but a fingerprint of personal data can still count as pseudonymised personal data under the GDPR, so cover ROOTKey's role in your processing records and the Data Processing Agreement. We recommend that your legal team confirms the roles that apply to your case.