# GDPR: the php2shell risks it governs

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Each GDPR clause or control the GRC desk cites, the php2shell risks mapped to it and who owns them.

[Frameworks](../index.html) / GDPR

# GDPR: the php2shell risks it governs

A PHP application that executes an attacker's code exposes the personal data it holds; whoever controls that data answers for its security and for notifying a breach.

**Full name** General Data Protection Regulation, Regulation (EU) 2016/679 · **Publisher** European Union · **Version** 2016, in force 25 May 2018 · [the official text](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

## Clauses and controls

| Control | What it asks (paraphrased) | Risks mapped | Owned or regulated by |
|---|---|---|---|
| **Art.5(1)(f)** | Integrity and confidentiality: personal data processed with appropriate security | [R06-1 Personal data taken from a compromised PHP application](../../../grc/risks/r06-1/index.html) **15** high | [Data protection officer](../../../grc/stakeholders/dpo/index.html) |
| **Art.24** | Responsibility of the controller: measures appropriate to the risk | [R06-1 Personal data taken from a compromised PHP application](../../../grc/risks/r06-1/index.html) **15** high | [Data protection officer](../../../grc/stakeholders/dpo/index.html) |
| **Art.28** | Processors: the controller uses only processors that give sufficient guarantees | [R06-1 Personal data taken from a compromised PHP application](../../../grc/risks/r06-1/index.html) **15** high | [Data protection officer](../../../grc/stakeholders/dpo/index.html) |
| **Art.32** | Security of processing, including a process for regularly testing and evaluating it | [R06 A compromise becomes a reportable breach](../../../grc/risks/r06/index.html) **15** high [R06-1 Personal data taken from a compromised PHP application](../../../grc/risks/r06-1/index.html) **15** high [R10-2 A vault key or token published](../../../grc/risks/r10-2/index.html) **10** medium | [Data protection officer](../../../grc/stakeholders/dpo/index.html), [Organisations running PHP](../../../grc/stakeholders/operators/index.html), [EU and member-state CERTs](../../../grc/stakeholders/eu-agencies/index.html), [Board and executives](../../../grc/stakeholders/board/index.html), [The editor](../../../grc/stakeholders/newsroom-editor/index.html) |
| **Art.33** | Notifying a personal data breach to the supervisory authority within 72 hours | [R06 A compromise becomes a reportable breach](../../../grc/risks/r06/index.html) **15** high [R06-1 Personal data taken from a compromised PHP application](../../../grc/risks/r06-1/index.html) **15** high | [Data protection officer](../../../grc/stakeholders/dpo/index.html), [Organisations running PHP](../../../grc/stakeholders/operators/index.html), [EU and member-state CERTs](../../../grc/stakeholders/eu-agencies/index.html), [Board and executives](../../../grc/stakeholders/board/index.html) |
| **Art.34** | Communicating a high-risk personal data breach to the people affected | [R06 A compromise becomes a reportable breach](../../../grc/risks/r06/index.html) **15** high [R06-1 Personal data taken from a compromised PHP application](../../../grc/risks/r06-1/index.html) **15** high | [Data protection officer](../../../grc/stakeholders/dpo/index.html), [Organisations running PHP](../../../grc/stakeholders/operators/index.html), [EU and member-state CERTs](../../../grc/stakeholders/eu-agencies/index.html), [Board and executives](../../../grc/stakeholders/board/index.html) |


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/grc/frameworks/gdpr/index.html