GDPR

GDPR Compliance Checklist

0% Complete (0/60)

1. Accountability, Governance & Internal Compliance Structure

Relevant GDPR Articles: 5(2), 24, 25, 30, 39

Documented GDPR accountability framework

You have formal documentation demonstrating compliance with GDPR obligations (Article 5(2)). This includes policies, procedures, governance charters, training logs, internal audits, and decision-making records.

Formal assignment of responsibilities

Clear designation of roles for data protection responsibilities across the organisation, including senior-level oversight (Article 24).

Assessment of whether a Data Protection Officer (DPO) is required

If applicable (Articles 37–39), a qualified DPO has been appointed with direct reporting to the highest management level. If not required, a documented justification must be retained.

Data protection training programme

Regular and role-specific training for all employees handling personal data, with attendance records and periodic assessments.

Privacy by Design and Default mechanisms

Technical and organisational controls embedded into systems and processes in accordance with Article 25, including role-based access, minimisation, and configuration safeguards.

2. Data Mapping & Records of Processing Activities (RoPA)

Relevant GDPR Articles: 5, 30

Full inventory of personal data processing activities

A complete catalogue identifying: categories of data subjects, personal data types, processing purposes, systems, processors, transfers, retention periods, and legal bases.

Records of Processing Activities (RoPA) maintained

Controllers and processors maintain Articles 30(1) and 30(2) compliant RoPA. RoPA is updated following system changes, new processing, or new tools/vendors.

Data flow mapping

End-to-end mapping of personal data flows across on-premises, cloud systems, mobile applications, processors, and third-country transfers.

Identification of special categories & criminal data

Article 9 (special categories) and Article 10 (criminal) data processing is documented with strict access controls and lawful bases.

Data minimisation applied at collection and storage

Evidence that personal data collected is adequate, relevant, and limited to what is necessary (Article 5(1)(c)).

3. Lawful Bases for Processing & Consent Management

Relevant GDPR Articles: 6, 7, 8, 9

Lawful basis documented for each processing purpose

Every act of processing must be grounded in one of the lawful bases under Article 6(1). Documentation explicitly links the basis to the purpose.

Legitimate Interests Assessments (LIAs) completed

When relying on Article 6(1)(f), you have completed a legitimate interests assessment, including: purpose test, necessity test, and balancing test with safeguards.

Consent mechanisms compliant with Article 7

Consent is freely given, specific, informed, unambiguous, and demonstrated. No pre-ticked boxes, no bundled consent, no forced opt-in for non-essential processing.

Consent withdrawal processes implemented

Withdrawal is as easy as granting consent (Article 7(3)). Systems must stop processing immediately when consent is withdrawn.

Age verification for children’s data where required

Where services target children or knowingly process minors’ data, Article 8 compliance is implemented, including parental authorization mechanisms.

4. Transparency Obligations & Privacy Notices

Relevant GDPR Articles: 12–14

Privacy notices are comprehensive and GDPR-compliant

Notices include: controller identity, contact details, DPO (where applicable), processing purposes, legal bases, legitimate interests, recipients, transfers, retention periods, data subject rights, complaint mechanisms, and sources of data.

Notices use clear and plain language

Required under Article 12(1). No excessively legalistic text, no obfuscation, no ambiguities.

Separate notices for distinct processing contexts

Website users, employees, candidates, CCTV, mobile apps, analytics, cookies, marketing, and B2B processing each have tailored notices.

Translated notices where required

If servicing multiple EU jurisdictions, notices must be available in relevant local languages according to national DPA expectations.

Version control maintained

Each update is versioned, dated, and archived as part of GDPR accountability.

5. Cookies, Tracking Technologies & Online Identifiers

Relevant GDPR Articles: 4, 6, 7; ePrivacy Directive (2002/58/EC)

Complete inventory of cookies, tags, scripts, and tracking technologies

Covers HTTP cookies, local storage, pixel tags, fingerprinting, session identifiers, ad-tech trackers, analytics tools, and chat widgets.

Prior consent for non-essential cookies

Analytics, advertising, and behavioural tracking require active opt-in consent before activation. No “implied consent”, no “scroll equals accept”.

Granular consent categories implemented

Users can accept or reject categories such as: essential, analytics, advertising, personalisation.

Consent stored with timestamp and policy version

Proof of consent is recorded and retained in accordance with accountability obligations.

Privacy notice includes clear explanation of tracking technologies

Including retention, purpose, providers, third-country transfers, and user rights.

6. Data Subject Rights (DSR) Procedures

Relevant GDPR Articles: 15–22

Formal DSR response procedure

Documented workflows for access, rectification, erasure, objection, withdrawal, portability, and restriction requests. Staff know how to recognise and escalate DSRs.

Identity verification procedure

DSRs must be validated proportionately and securely without collecting excessive new personal data.

Response deadlines met

Responses provided within 30 days (Article 12(3)), with justified extensions documented.

Portability format compliant with Article 20

Machine-readable, commonly used formats (e.g., CSV, JSON, XML).

Erasure and objection requests properly evaluated

Exceptions (legal obligation, defence of claims, overriding legitimate interests) are documented with legal reasoning.

7. Controller–Processor Relationships

Relevant GDPR Articles: 26–28

Article 28-compliant Data Processing Agreements (DPAs) with all processors

DPAs include: processing instructions, confidentiality obligations, security measures, sub-processor approvals, audits, assistance with DSRs, and deletion of data post-contract.

Due diligence performed before onboarding processors

Security assessment, data handling review, certifications, sub-processor lists, incident history, financial stability.

Joint controller arrangements documented

Where applicable, Article 26 agreements define responsibilities transparently.

Sub-processor management procedures

Processors must obtain written authorization and maintain a transparent list of sub-processors.

Regular processor audits or evidence reviews

Annual or risk-based compliance reviews of processors’ controls.

8. International Data Transfers

Relevant GDPR Articles: 44–49

Transfer mechanism identified for each international data flow

Approved mechanisms: adequacy decisions, Standard Contractual Clauses (SCCs), BCRs, derogations under Article 49. Each mechanism is documented.

Transfer Impact Assessments (TIAs) completed

Required for SCC transfers following Schrems II. Evaluates destination country law, surveillance risks, and supplementary safeguards.

Supplementary measures implemented where required

Encryption, pseudonymisation, architectural separation, or policy controls.

Processor and sub-processor transfer chains documented

Full transparency from primary processor to all downstream vendors.

Third-country notices provided to individuals

Required in transparency obligations (Articles 13–14).

9. Information Security & Technical/Organisational Measures (TOMs)

Relevant GDPR Articles: 5(1)(f), 32

Risk-based security controls implemented

Appropriate encryption, access controls, MFA, network security, secure storage, monitoring, and logging based on Article 32(1).

Regular vulnerability scanning & penetration testing

Risk-based schedule with documented remediation actions.

Data classification model applied

Personal data, special category data, confidential data are classified with appropriate protection.

Backup and disaster recovery procedures tested

Includes RPO/RTO definitions and periodic validation tests.

Employee access controls based on least privilege

Role-based access, access logging, offboarding controls, periodic access reviews.

10. Data Protection Impact Assessments (DPIAs)

Relevant GDPR Articles: 35–36

DPIA screening performed for new processing activities

Each new project is assessed for DPIA triggers, including monitoring, profiling, special categories, or large-scale processing.

DPIAs conducted where risk is high

Includes description of processing, purpose, necessity assessment, risk evaluation, and mitigation measures.

Consultation with DPO documented

DPO advice included in DPIA record as required by Article 39.

Consultation with supervisory authority if high risk remains

Mandatory under Article 36 where risks cannot be mitigated adequately.

Periodic review of DPIAs

Particularly where processing evolves or risks change.

11. Data Breach Detection, Reporting & Response

Relevant GDPR Articles: 33–34

Documented incident response plan

Clear roles, escalation criteria, investigation processes, communication channels, and containment steps.

Breach severity assessment methodology

Defined criteria for evaluating risk to individuals, including likelihood, severity, data type, identifiability, and potential harm.

DPA notification within 72 hours where required

Article 33 obligation. Notifications include root cause, scope, mitigation, and cross-border impact.

Data subject notification process for high-risk breaches

Article 34 compliant notifications using clear, plain language and recommended protective steps.

Breach register maintained

All breaches — even those not reported — recorded with facts, effects, and corrective measures.

12. Ongoing Monitoring, Auditing & Continuous Compliance

Relevant GDPR Articles: 24, 32, 39

Annual GDPR compliance audit

Formal internal or external audit covering all obligations under GDPR Articles 5–50.

Review of policies and procedures

Privacy notice, retention schedules, security policies, cookie policy, and processor agreements reviewed at least annually.

Monitoring of regulatory guidance

EDPB opinions, European Court of Justice decisions, DPA enforcement trends reviewed and integrated into policy updates.

Documentation of corrective actions

Non-compliance items recorded with owner, remediation actions, and deadlines.

Board-level reporting

Periodic reporting to senior management on GDPR risks, incidents, audits, and improvement plans.

0% Complete (0/60)

Need Help Getting To 100% Compliant?

Our GDPR experts can assist you in all areas of GDPR. Contact Us Here

Free GDPR Risk Snapshot

Get a fast, high-level assessment of your website and data practices and identify your biggest GDPR risks before a regulator or customer does.

Cookie and tracking review
Privacy and cookie policy gaps
Security and access control flags
Marketing and consent issues

Request your snapshot

Typical SME Risk Areas

Unlawful email marketing
Non-compliant cookie banners
Weak access controls
No clear retention policy
Ignored data subject requests

Addressing these five areas alone can significantly reduce your exposure to fines.

Need Hands-On Help?

If you need more than guidance, consider a structured GDPR implementation project covering inventory, policies, DPIAs, training and technical hardening.

Use the main contact form to request a tailored proposal for your organisation.

Contact