Data structures and data formats

Name: Guardiso
Price: 199 EUR

Last updated: 31 October 2026

This page sets out which data sets you can download from Guardiso, the format each file comes in, and exactly what every column means. The page is public and requires no account, so that your procurement team, your lawyer and a future provider can check it before the agreement is concluded rather than at the point of leaving.

Maintaining this register is an obligation of a provider of a data processing service. It is required by Article 26(1)(b) of Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data.

We publish the same register in a machine-readable form, free of charge and without an account, at /api/formaty-danych.

1. Register of controls with implementation status

Where you download it from	Audit Package
Format	CSV in a ZIP archive
File name	`controls.csv`

Column in the file	Type of value	What the column means
`Code`	Text	The identifier of the control in the standard, for example A.5.15.
`Title`	Text	The name of the control.
`Domain`	Text	The domain the control belongs to, for example access control.
`Framework`	Text	The standard the control comes from, for example ISO 27001.
`Status`	Value from a fixed list	The implementation status of the control in the organisation.
`Notes`	Text	The organisation's own note about this control.
`Last Reviewed`	Date and time	When the control was last reviewed.

2. List of policies and procedures

Where you download it from	Audit Package
Format	CSV in a ZIP archive
File name	`policies.csv`

Column in the file	Type of value	What the column means
`Title`	Text	The title of the document.
`Status`	Value from a fixed list	The status of the document, for example draft or approved.
`Category`	Text	The subject category of the document.
`Version`	Number	The version number of the document.
`Approved By`	Text	Who approved the document.
`Approved At`	Date and time	When the document was approved.
`Created`	Date and time	When the document was created.
`Updated`	Date and time	When the document was last changed.

3. Risk register

Where you download it from	Audit Package
Format	CSV in a ZIP archive
File name	`risks.csv`

Column in the file	Type of value	What the column means
`Title`	Text	The name of the risk.
`Risk Level (residual)`	Value from a fixed list	The level of risk after the controls have been taken into account, calculated according to the methodology adopted by the organisation.
`Risk Level (inherent)`	Value from a fixed list	The level of risk before the controls are taken into account.
`Status`	Value from a fixed list	The status of the treatment of the risk.
`Category`	Text	The category of the risk.
`Likelihood`	Number	The assessment of the likelihood of occurrence.
`Impact`	Number	The assessment of the impact the risk would have.
`Created`	Date and time	When the risk was entered in the register.
`Updated`	Date and time	When the risk was last changed.

4. Index of the evidence register

Where you download it from	Audit Package
Format	CSV in a ZIP archive
File name	`evidence/index.csv`

Column in the file	Type of value	What the column means
`Title`	Text	The name of the evidence item.
`Type`	Value from a fixed list	The type of evidence, for example a screenshot or a document.
`Status`	Value from a fixed list	The status of the evidence item worked out from its expiry date: valid, expiring within 30 days or pending review.
`Source`	Text	Where the evidence came from, for example which provider.
`Collected At`	Date and time	When the evidence was collected.
`Expiry`	Date and time	The date until which the evidence remains valid.
`File Size`	Number	The size of the attached file in bytes. A value of zero means that the evidence item has no file attached.
`State`	Text	The name of the state from the Status column in the language of the package, for example “Valid” or “Expiring”.

5. Register of data processing agreements collected by the customer

Where you download it from	GDPR compliance module
Format	CSV in a ZIP archive
File name	`dpa-register.csv`

Column in the file	Type of value	What the column means
`Processor`	Text	The name of the entity processing the data.
`Contact`	Text	The contact person at the processor.
`Country`	Text	The country in which the data is processed.
`Subject Matter`	Text	The subject matter of the processing, that is to say why the data is processed.
`Status`	Value from a fixed list	The status of the agreement, for example signed or being prepared.
`Criticality`	Value from a fixed list	How critical the entity is to the operation of the organisation.
`Signed At`	Date and time	When the agreement was signed.
`Valid Until`	Date and time	The date until which the agreement is in force.
`Annual Review`	Date and time	The date of the next annual review.
`ISO 27001`	Value from a fixed list	Whether the processor holds an ISO 27001 certificate.
`SOC 2`	Value from a fixed list	Whether the processor holds a SOC 2 report.
`Sub-processors`	Several values in one field	The further processors used by that entity.
`International Transfer`	Value from a fixed list	Whether the data leaves the European Economic Area.
`SCC Module`	Value from a fixed list	Which module of the standard contractual clauses forms the basis for the transfer.
`Document URL`	Web address	The address of the file containing the agreement. The file itself is in the same archive.

6. Cookie consent log

Where you download it from	GDPR compliance module
Format	CSV
File name	`consent-log-YYYY-MM-DD.csv`

Column in the file	Type of value	What the column means
`id`	Text	The internal identifier of the log entry.
`created_at`	Date and time	When the consent was given or withdrawn.
`action`	Value from a fixed list	What the visitor did, for example accepted or rejected.
`visitor_id`	Text	The identifier of the visitor assigned in the browser.
`language`	Text	The language in which the consent request was shown.
`ip_anonymized`	Text	The network address with the last part removed so that it does not identify a person.
`page_url`	Web address	The page on which the visitor answered the consent request.
`choices`	Several values in one field	Which categories of cookies the visitor agreed to.
`user_agent`	Text	The description of the browser used by the visitor.

7. Security questionnaire with its answers

Where you download it from	Questionnaires module
Format	CSV
File name	`questionnaire.csv`

Column in the file	Type of value	What the column means
`#`	Number	The sequential number of the question in the questionnaire.
`Category`	Text	The area the question concerns.
`Question`	Text	The text of the question.
`Answer`	Text	The answer given by the organisation.
`Status`	Value from a fixed list	The status of the answer, for example pending or approved.
`Confidence`	Number	A percentage showing how confident the assistant was in its proposal. An empty field means an answer written by a person.
`Sources`	Several values in one field	The organisation's documents on which the answer is based.

8. Register of information assets

Where you download it from	Asset register, More menu. In the Polish file a semicolon separates the columns, and in other languages a comma.
Format	CSV
File name	`assets-YYYY-MM-DD.csv`

Column in the file	Type of value	What the column means
`ID`	Text	The internal identifier of the asset in Guardiso.
`Name`	Text	The name of the asset.
`Type`	Value from a fixed list	The type of asset: hardware, software, data, service, people or facility.
`Criticality`	Value from a fixed list	The criticality: critical, high, medium or low. An empty field means the asset has not been rated yet.
`Owner`	Text	The person responsible for the asset. An empty field means no owner has been assigned, and “Someone outside the team” means an owner who no longer belongs to the team.
`Location`	Text	The place where the asset is located.
`Vendor`	Text	The vendor of the asset.
`Version`	Text	The version of the asset, for example of the software.
`IP Address`	Text	The network address of the asset.
`Description`	Text	The description of the asset on a single line.
`Encryption`	Value from a fixed list	Encryption: yes when it is confirmed, not_specified when nobody has confirmed it, or not_applicable when it does not apply to this type of asset.
`Device Type`	Value from a fixed list	The type of device, for example laptop or server.
`OS Version`	Text	The version of the operating system of the device.
`Antivirus`	Value from a fixed list	The status of the antivirus protection: active, outdated or missing.
`Last Patch`	Date and time	The day of the last patch of the device.
`MDM`	Value from a fixed list	Device management: yes when it is confirmed, and not_specified for hardware when nobody has confirmed it. Empty for software without confirmation and for other assets.
`Tags`	Several values in one field	The labels of the asset separated by semicolons.
`Source`	Text	Where the entry came from, described in the language of the person downloading the file.
`Created`	Date and time	When the asset was added to the register.
`Updated`	Date and time	When the asset was last changed.

The register describes data sets that have named columns. Documents downloaded as PDF, DOCX and Markdown, and files you uploaded yourself, come in the form in which you uploaded them or in which they were created, so they have no columns to describe. The full list of what you can take with you is set out in the exit and data portability terms.

Exit and Data Portability Terms

If you need a description of the structure before you download the data, or you want to ask what a particular field means, write to contact@guardiso.com. We answer free of charge, including when the question comes from a new provider you have nominated.