Data structures and data formats

Last updated: 15 September 2026

This page sets out which data sets you can download from Guardiso, the format each file comes in, and exactly what every column means. The page is public and requires no account, so that your procurement team, your lawyer and a future provider can check it before the agreement is concluded rather than at the point of leaving.

Maintaining this register is an obligation of a provider of a data processing service. It is required by Article 26(1)(b) of Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data.

We publish the same register in a machine-readable form, free of charge and without an account, at /api/formaty-danych.

1. Register of controls with implementation status

Where you download it from	Audit Package
Format	CSV w archiwum ZIP
File name	`controls.csv`

Column in the file	Type of value	What the column means
`Code`	Text	The identifier of the control in the standard, for example A.5.15.
`Title`	Text	The name of the control.
`Domain`	Text	The domain the control belongs to, for example access control.
`Framework`	Text	The standard the control comes from, for example ISO 27001.
`Status`	Value from a fixed list	The implementation status of the control in the organisation.
`Notes`	Text	The organisation's own note about this control.
`Last Reviewed`	Date and time	When the control was last reviewed.

2. List of policies and procedures

Where you download it from	Audit Package
Format	CSV w archiwum ZIP
File name	`policies.csv`

Column in the file	Type of value	What the column means
`Title`	Text	The title of the document.
`Status`	Value from a fixed list	The status of the document, for example draft or approved.
`Category`	Text	The subject category of the document.
`Version`	Number	The version number of the document.
`Approved By`	Text	Who approved the document.
`Approved At`	Date and time	When the document was approved.
`Created`	Date and time	When the document was created.
`Updated`	Date and time	When the document was last changed.

3. Risk register

Where you download it from	Audit Package
Format	CSV w archiwum ZIP
File name	`risks.csv`

Column in the file	Type of value	What the column means
`Title`	Text	The name of the risk.
`Risk Level (residual)`	Value from a fixed list	The level of risk after the controls have been taken into account, calculated according to the methodology adopted by the organisation.
`Risk Level (inherent)`	Value from a fixed list	The level of risk before the controls are taken into account.
`Status`	Value from a fixed list	The status of the treatment of the risk.
`Category`	Text	The category of the risk.
`Likelihood`	Number	The assessment of the likelihood of occurrence.
`Impact`	Number	The assessment of the impact the risk would have.
`Created`	Date and time	When the risk was entered in the register.
`Updated`	Date and time	When the risk was last changed.

4. Index of the evidence register

Where you download it from	Audit Package
Format	CSV w archiwum ZIP
File name	`evidence/index.csv`

Column in the file	Type of value	What the column means
`Title`	Text	The name of the evidence item.
`Type`	Value from a fixed list	The type of evidence, for example a screenshot or a document.
`Status`	Value from a fixed list	The status of the evidence item, for example collected or pending.
`Source`	Text	Where the evidence came from, for example which provider.
`Collected At`	Date and time	When the evidence was collected.
`Expiry`	Date and time	The date until which the evidence remains valid.
`File Size`	Number	The size of the attached file in bytes. A value of zero means that the evidence item has no file attached.

5. Register of data processing agreements collected by the customer

Where you download it from	GDPR compliance module
Format	CSV w archiwum ZIP
File name	`dpa-register.csv`

Column in the file	Type of value	What the column means
`Processor`	Text	The name of the entity processing the data.
`Contact`	Text	The contact person at the processor.
`Country`	Text	The country in which the data is processed.
`Subject Matter`	Text	The subject matter of the processing, that is to say why the data is processed.
`Status`	Value from a fixed list	The status of the agreement, for example signed or being prepared.
`Criticality`	Value from a fixed list	How critical the entity is to the operation of the organisation.
`Signed At`	Date and time	When the agreement was signed.
`Valid Until`	Date and time	The date until which the agreement is in force.
`Annual Review`	Date and time	The date of the next annual review.
`ISO 27001`	Value from a fixed list	Whether the processor holds an ISO 27001 certificate.
`SOC 2`	Value from a fixed list	Whether the processor holds a SOC 2 report.
`Sub-processors`	Several values in one field	The further processors used by that entity.
`International Transfer`	Value from a fixed list	Whether the data leaves the European Economic Area.
`SCC Module`	Value from a fixed list	Which module of the standard contractual clauses forms the basis for the transfer.
`Document URL`	Web address	The address of the file containing the agreement. The file itself is in the same archive.

6. Cookie consent log

Where you download it from	GDPR compliance module
Format	CSV
File name	`consent-log-RRRR-MM-DD.csv`

Column in the file	Type of value	What the column means
`id`	Text	The internal identifier of the log entry.
`created_at`	Date and time	When the consent was given or withdrawn.
`action`	Value from a fixed list	What the visitor did, for example accepted or rejected.
`visitor_id`	Text	The identifier of the visitor assigned in the browser.
`language`	Text	The language in which the consent request was shown.
`ip_anonymized`	Text	The network address with the last part removed so that it does not identify a person.
`page_url`	Web address	The page on which the visitor answered the consent request.
`choices`	Several values in one field	Which categories of cookies the visitor agreed to.
`user_agent`	Text	The description of the browser used by the visitor.

7. Security questionnaire with its answers

Where you download it from	Questionnaires module
Format	CSV
File name	`questionnaire.csv`

Column in the file	Type of value	What the column means
`#`	Number	The sequential number of the question in the questionnaire.
`Category`	Text	The area the question concerns.
`Question`	Text	The text of the question.
`Answer`	Text	The answer given by the organisation.
`Status`	Value from a fixed list	The status of the answer, for example pending or approved.
`Confidence`	Number	A percentage showing how confident the assistant was in its proposal. An empty field means an answer written by a person.
`Sources`	Several values in one field	The organisation's documents on which the answer is based.

The register describes data sets that have named columns. Documents downloaded as PDF, DOCX and Markdown, and files you uploaded yourself, come in the form in which you uploaded them or in which they were created, so they have no columns to describe. The full list of what you can take with you is set out in the exit and data portability terms.

Exit and Data Portability Terms

If you need a description of the structure before you download the data, or you want to ask what a particular field means, write to kontakt@guardiso.com. We answer free of charge, including when the question comes from a new provider you have nominated.