# GDPR Article 93 — Committee procedure - Source: https://support.icompaas.com/compliance/gdpr/article-93-committee-procedure - Section: [Compliance](https://support.icompaas.com/compliance) › [GDPR (Regulation (EU) 2016/679)](https://support.icompaas.com/compliance/gdpr) › Articles 91–100 - Last updated: 2026-06-05 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **GDPR**·Article `Article 93`·low·Component: **Chapter X: Delegated and Implementing Acts** ## What this control requires > This control establishes that the Commission shall be assisted by a committee, as defined in Regulation (EU) No 182/2011, to assist in the implementation of GDPR, with applicable procedures outlined in Articles 5 and 8 of that regulation. This control addresses Delegated and Implementing Acts. > > — GDPR, Article Article 93 ### In plain English This control establishes that the Commission shall be assisted by a committee, as defined in Regulation (EU) No 182/2011, to assist in the implementation of GDPR, with applicable procedures outlined in Articles 5 and 8 of that regulation. In practice, this means you can prove you procedure procedure-level controls on a defined cadence. ## Why it matters GDPR administrative fines reach the greater of €20 million or 4% of global annual turnover. The European Data Protection Board (EDPB) coordinates supervisory-authority enforcement across the EU/EEA, and DPAs publish enforcement decisions citing specific Articles. ## What an auditor looks for A DPA or privacy auditor expects: a Records of Processing Activities (RoPA) entry, a documented lawful basis, evidence the Article's data-subject right is operationalised end-to-end, a named DPO contact (where required), and Article 30 records that match what the front-end actually does. Within **Chapter X: Delegated and Implementing Acts**, the assessor will trace your implementation back to the catalogue reference (Article Article 93) and look for objective evidence on the latest two assessment cycles. ## How to implement #### Policy Management **Docs.** Keep each policy in version-controlled Markdown alongside the code that implements it; ship a signed PDF snapshot at each annual review and link the SHA into the SoA. ### Operational checklist - **Procedure.** Document the trigger, the owner and the cadence. - **Committee.** Document the trigger, the owner and the cadence. - **Commission.** Document the trigger, the owner and the cadence. - **Scope:** procedure, commission. ## Evidence to collect - **Policy Document.** A signed and version-controlled policy / standard / procedure document. Signed policy or standard documents the safeguard. Focus: Committee procedure. ## Common pitfalls - Policies that no engineer has read; the version in Confluence drifts from the version that's actually being enforced. ## How it maps to other frameworks Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit. - [**CIS Controls v8 2.6** — Allowlist Authorized Libraries](https://support.icompaas.com/compliance/cis-controls-v8/2-6-allowlist-authorized-libraries) - [**ISO/IEC 27001:2022 A.5.5** — Contact with authorities](https://support.icompaas.com/compliance/iso-27001-2022/a-5-5-contact-with-authorities) - [**SOC 2 (2017 TSC) CC2.3** — External Communication on Internal Control Matters](https://support.icompaas.com/compliance/soc-2-trust-services-criteria/cc2-3-external-communication-on-internal-control-matters) - [**HIPAA (45 CFR Part 164) 164.308(a)(3)(ii)(B)** — Workforce security - Workforce Clearance Procedure](https://support.icompaas.com/compliance/hipaa/164-308-a-3-ii-b-workforce-security-workforce-clearance-procedure) - [**ISO/IEC 27701:2025 A.3.15** — Independent review](https://support.icompaas.com/compliance/iso-27701-2025/a-3-15-independent-review) ## Related controls in GDPR - [**Article Article 63** — Consistency mechanism](https://support.icompaas.com/compliance/gdpr/article-63-consistency-mechanism) - [**Article Article 69** — Independence](https://support.icompaas.com/compliance/gdpr/article-69-independence) - [**Article Article 84** — Penalties](https://support.icompaas.com/compliance/gdpr/article-84-penalties) - [**Article Article 98** — Review of other Union legal acts on data protection](https://support.icompaas.com/compliance/gdpr/article-98-review-of-other-union-legal-acts-on-data-protection) - [**Article Article 66** — Urgency procedure](https://support.icompaas.com/compliance/gdpr/article-66-urgency-procedure) - [**Article Article 85** — Processing and freedom of expression and information](https://support.icompaas.com/compliance/gdpr/article-85-processing-and-freedom-of-expression-and-information) ## References - [European Union — GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) - Catalogue identifier: `Article Article 93` Topics: governance riskpolicy management ## Related compliance guidance - [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): Start with the full GDPR implementation guide — scope, roadmap, evidence and how the assessment runs. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): The security management system most EU procurement teams ask for alongside a DPA; its controls supply much of the Article 32 evidence. - [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If engineering or support teams sit in India, the same data flows are also subject to India’s Digital Personal Data Protection Act.