Checks, GDPR, Early access
A GDPR readiness check that reads the documents you already have.
nerix reads your documents and records against the GDPR duties of a business in the EU, shows what is found, partly found or not found, and asks you only where it cannot tell. Gaps become tasks with an owner and a date. Early access.
The free plan is one seat and 3,000 credits a month, never charged.
01What nerix checks
Thirty-eight duties, from the register of processing to the rights of people.
The library holds the General Data Protection Regulation as 38 requirements, in full with a link to the official text on EUR-Lex. They include the processing register and lawful basis, processor agreements, the data protection impact assessment, breach handling and notification, the rights of data subjects, retention and deletion, the data protection officer, protection by design and security, transparency, consent, and international transfers.
nerix looks in your documents and records for each one. A document that only mentions a duty counts as Partly found, with its passage shown. No evidence at all counts as Not found. When it cannot tell, it asks you one short question, and your answer settles it without another model call. A person confirms or changes every result.
- Records and basisProcessing register and lawful basis, purpose limitation, data minimisation, accuracy, retention periods and deletion.
- People and their rightsTransparency, valid consent, consent records and withdrawal, objection, handling requests, automated decisions.
- Processors and transfersProcessor agreements, sub-processors, joint controllers, international transfers.
- Security and breachesProtection by design and security, breach handling and notification, availability and recovery, impact assessments, the data protection officer.
02Does it apply to you
nerix says whether the law applies, and why.
A law applies by default. nerix says it does not apply only with positive evidence from your own business facts and high confidence, and never because a fact is missing. The rule for the GDPR follows Article 3: you process personal data and you are established in the European Economic Area or you have data subjects there.
Parts of the law depend on more facts. Whether you need a data protection officer, whether you handle special-category data and whether a data protection impact assessment is needed are separate rules with their own citations. When nerix cannot tell, it asks you. You can mark a law Not applicable for us only with a reason, which is kept with your name.
- ScopeProcessing personal data, with an establishment or data subjects in the EEA (Article 3).
- OfficerArticle 37, judged from your facts. You are asked when nerix cannot tell.
- Special data and impact assessmentsArticles 9 and 35, asked about when your facts do not settle it.
- CookiesThe ePrivacy rule for websites that reach people in the EU.
03Where it stops
It checks your paperwork, not your data or your lawyer's view.
nerix reads documents and records. It does not scan your systems to find personal data, test your security, or decide your lawful basis. It cannot say you comply. Its rules for who is covered were written from the regulation with their citations and carry no recorded human review yet.
The library's GDPR entry is written with the Dutch implementation in mind (AVG and UAVG), so a few requirements mention Dutch details such as the citizen service number. The UK has its own entry for the UK GDPR and the Data Protection Act 2018. Other national additions are not included. Readiness information, not an audit or legal advice.
Readiness information, not an audit, a certificate or legal advice.
04Questions
Questions
Does nerix make us GDPR compliant?
No. Only you can be compliant, and only a regulator or court decides. nerix reads your documents and records against the duties, shows what is found and missing, and turns the gaps into tasks.
Does the GDPR apply to my business?
Almost every business that has customers or staff in the EEA, and some outside it, is covered. nerix applies Article 3 to your facts and says why a law does or does not apply. It treats a missing fact as unknown, never as no.
Which version of the GDPR is it?
Regulation (EU) 2016/679, in full, with a link to the official text. The library entry is the Dutch edition (AVG with the UAVG). The UK GDPR is a separate entry.
Can it make our privacy notice or records?
The readiness check does not write them. The free template library has a privacy notice, a data processing agreement, a privacy impact assessment, a data breach notice and a data deletion request. The plan also has a GDPR records review every six months.
Does nerix find personal data in our files?
No. It looks for the documents that a duty asks for, such as a register of processing or a breach procedure. It does not scan your systems for personal data.
What does a check cost?
The price is shown before you start: credits per requirement checked, plus a one-time charge the first time each document is read. See the pricing page.
Need something this does not do? We build it into your workspace. Built for you
- ISO 27001 information securityCheck your documents against the ISO 27001 clauses and all 93 Annex A controls, build the statement of applicability from the result, and invite your auditor.
- NIS2 cyber securityCheck your documents against 35 NIS2 duties, from board oversight to the 24 hour warning and 72 hour report, and see whether NIS2 applies to your business.
- EU AI ActCheck your documents against 45 duties of the EU AI Act, from the register of AI systems to human oversight, and see whether the Act applies to you.
- HKZ care certificationPrepare for HKZ certification in Dutch care. Check your documents against the HKZ general standard or one of 35 sector standards and plan the audit year.
- Checks, the whole productThe plan, internal checks, issues and business reviews that every readiness check sits beside.
- TemplatesFree policy, register and checklist templates you can fill in and download.
Keep reading
Quality and audits7 min read
GDPR checklist for small businesses
A GDPR checklist for small businesses, article by article. Lawful basis, privacy notice, processors, security, 72 hour breach reports and data subject requests.