# GDPR Article 72 — Procedure

- Source: https://support.icompaas.com/compliance/gdpr/article-72-procedure
- Section: [Compliance](https://support.icompaas.com/compliance) › [GDPR (Regulation (EU) 2016/679)](https://support.icompaas.com/compliance/gdpr) › Articles 71–80
- Last updated: 2026-06-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**GDPR**·Article `Article 72`·low·Component: **Chapter VII: Cooperation and Consistency**

## What this control requires

> Ensure the European Data Protection Board adopts decisions by simple majority, except where the Regulation specifies otherwise, and establishes its own rules of procedure and operational arrangements by a two-thirds majority. This control addresses Remedies, Liability and Penalties.
> 
> — GDPR, Article Article 72

### In plain English

Ensure the European Data Protection Board adopts decisions by simple majority, except where the Regulation specifies otherwise, and establishes its own rules of procedure and operational arrangements by a two-thirds majority. In practice, this means you can prove you data board-level controls on a defined cadence.

## Why it matters

GDPR administrative fines reach the greater of €20 million or 4% of global annual turnover. The European Data Protection Board (EDPB) coordinates supervisory-authority enforcement across the EU/EEA, and DPAs publish enforcement decisions citing specific Articles.

## What an auditor looks for

A DPA or privacy auditor expects: a Records of Processing Activities (RoPA) entry, a documented lawful basis, evidence the Article's data-subject right is operationalised end-to-end, a named DPO contact (where required), and Article 30 records that match what the front-end actually does.

Within **Chapter VII: Cooperation and Consistency**, the assessor will trace your implementation back to the catalogue reference (Article Article 72) and look for objective evidence on the latest two assessment cycles.

## How to implement

#### Policy Management

**Docs.** Keep each policy in version-controlled Markdown alongside the code that implements it; ship a signed PDF snapshot at each annual review and link the SHA into the SoA.

### Operational checklist

-   **Data.** Document the trigger, the owner and the cadence.
-   **Cooperation.** Document the trigger, the owner and the cadence.
-   **Rules.** Document the trigger, the owner and the cadence.
-   **Consistency.** Document the trigger, the owner and the cadence.
-   **European.** Document the trigger, the owner and the cadence.
-   **Scope:** board, procedure, data protection board.

## Evidence to collect

-   **Policy Document.** A signed and version-controlled policy / standard / procedure document.

Signed policy or standard documents the safeguard. Focus: Procedure.

## Common pitfalls

-   Policies that no engineer has read; the version in Confluence drifts from the version that's actually being enforced.

## How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

-   [**BSI C5:2020 AM-06** — Asset Classification and Labelling](https://support.icompaas.com/compliance/bsi-c5-2020/am-06-asset-classification-and-labelling)
-   [**India DPDP Act 2023 PD-001** — Data Protection Impact Assessment Programme](https://support.icompaas.com/compliance/india-dpdp-act-2023/pd-001-data-protection-impact-assessment-programme)
-   [**NIST SP 800-171 Rev. 3 3.13.15** — Session Authenticity](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-13-15-session-authenticity)

## Related controls in GDPR

-   [**Article Article 66** — Urgency procedure](https://support.icompaas.com/compliance/gdpr/article-66-urgency-procedure)
-   [**Article Article 70** — Tasks of the Board](https://support.icompaas.com/compliance/gdpr/article-70-tasks-of-the-board)
-   [**Article Article 73** — Chair](https://support.icompaas.com/compliance/gdpr/article-73-chair)
-   [**Article Article 68** — European Data Protection Board](https://support.icompaas.com/compliance/gdpr/article-68-european-data-protection-board)
-   [**Article Article 69** — Independence](https://support.icompaas.com/compliance/gdpr/article-69-independence)
-   [**Article Article 74** — Tasks of the Chair](https://support.icompaas.com/compliance/gdpr/article-74-tasks-of-the-chair)

## References

-   [European Union — GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
-   Catalogue identifier: `Article Article 72`

Topics: governance riskpolicy management

## Related compliance guidance

- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): Start with the full GDPR implementation guide — scope, roadmap, evidence and how the assessment runs.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): The security management system most EU procurement teams ask for alongside a DPA; its controls supply much of the Article 32 evidence.
- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If engineering or support teams sit in India, the same data flows are also subject to India’s Digital Personal Data Protection Act.