Framework overlap

Does PSD2 SCA cover GDPR?

You hold PSD2 SCA and have been told to do GDPR. Here is how much overlaps, control by control.

63% of GDPR you already have

PSD2 SCA already covers about 63% of GDPR, leaving 10 of 27 controls as genuinely new work.

Already covered 0 Likely covered 17 New work 10

No control in PSD2 SCA maps directly to one in GDPR. Everything counted as covered is covered because both map to the same third standard, which is what a crosswalk is, but it is an inference rather than a lookup.

What is genuinely new work

Nothing in PSD2 SCA reaches these. This is the list to scope.

GDPR-Art.26
Joint controllers
GDPR-Art.27
Representatives of controllers or processors not established in the Union
GDPR-Art.29
Processing under the authority of the controller or processor
GDPR-Art.36
Prior consultation
GDPR-Art.44
General principle for transfers
GDPR-Art.45
Transfers on the basis of an adequacy decision
GDPR-Art.46
Transfers subject to appropriate safeguards
GDPR-Art.47
Binding corporate rules
GDPR-Art.49
Derogations for specific situations
GDPR-Art.8
Conditions applicable to child's consent
Show the 17 you already have
GDPR-Art.10
Processing of personal data relating to criminal convictions
GDPR-Art.11
Processing which does not require identification
GDPR-Art.24
Responsibility of the controller
GDPR-Art.25
Data protection by design and by default
GDPR-Art.28
Processor
GDPR-Art.30
Records of processing activities
GDPR-Art.32
Security of processing
GDPR-Art.33
Notification of a personal data breach to the supervisory authority
GDPR-Art.34
Communication of a personal data breach to the data subject
GDPR-Art.35
Data protection impact assessment
GDPR-Art.37
Designation of the data protection officer
GDPR-Art.38
Position of the data protection officer
GDPR-Art.39
Tasks of the data protection officer
GDPR-Art.5
Principles relating to processing of personal data
GDPR-Art.6
Lawfulness of processing
GDPR-Art.7
Conditions for consent
GDPR-Art.9
Processing of special categories of personal data

How this is calculated

Already covered means a mapping runs from a control in PSD2 SCA to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition