GDPR Compliance Checklist

The General Data Protection Regulation (GDPR) is the EU's comprehensive data protection law, in effect since May 2018. It applies to any organization that processes personal data of EU residents, regardless of where the organization is based. Compliance is not optional — violations can result in fines of up to €20 million or 4% of global annual turnover.

GDPR compliance is not a one-time project. It requires ongoing attention to how personal data is collected, processed, stored, shared, and deleted. This checklist covers the core requirements that every organization should address, organized into 8 categories that map to GDPR's key principles and obligations.

The checklist is designed to be practical, not exhaustive. It focuses on the obligations that apply to most small and mid-sized organisations, each with the GDPR article it comes from. Items marked optional apply only in some situations (for example consent, children's data or transfers), and you can mark them not applicable. For a deeper dive into specific areas, use our specialized tools: the DPIA Helper for impact assessments, the Data Flow Mapping Tool for Article 30 records, and the Breach Cost Calculator to understand your financial exposure.

These are the items the tool above checks, in 8 areas, with the article each comes from. The same list is available to AI assistants through our MCP server.

Lawfulness & Legal Basis (6 items)

Every processing activity needs one of the six legal bases in Article 6(1): consent, contract, legal obligation, vital interests, public task or legitimate interests. Special category data also needs an Article 9(2) condition. Guide: legitimate interest assessment.

• Legal basis documented for every processing activity (Art. 6)
• Consent meets GDPR requirements — freely given, specific, informed, unambiguous (Art. 4(11), 7) (optional)
• Consent can be withdrawn as easily as it was given (Art. 7(3)) (optional)
• Legitimate interest balancing tests are documented (Art. 6(1)(f)) (optional)
• Special category data has an Art. 9(2) condition, criminal data an Art. 10 basis (optional)
• Children's data processing has parental consent where required (Art. 8) (optional)

Transparency & Data Subject Rights (8 items)

People must be told what you do with their data (Articles 12 to 14) and be able to use their rights. Guides: what a privacy policy must contain and answering access requests.

• Privacy notice is clear, concise, plain language (Art. 12-14)
• Privacy notice covers identity, purposes, legal basis, retention, rights, recipients
• Subject Access Requests answered within one month, extendable by two months for complex requests (Art. 12(3), 15)
• Right to rectification process exists (Art. 16)
• Right to erasure / right to be forgotten process exists (Art. 17)
• Data portability process exists (Art. 20)
• Right to object process exists, including marketing opt-out (Art. 21)
• Automated decision-making safeguards in place: human intervention and a way to contest (Art. 22) (optional)

Data Minimization & Retention (5 items)

Collect only what each purpose needs and keep it no longer than necessary (Article 5(1)(c) and (e)). Guide: data retention policy.

• Only necessary data is collected for each purpose (Art. 5(1)(c))
• Retention periods defined for each processing activity
• Automated or scheduled deletion for expired data
• Data accuracy maintained with correction processes (Art. 5(1)(d))
• Pseudonymization or anonymization applied where feasible

Security Measures (7 items)

Article 32 requires security "appropriate to the risk", taking into account the state of the art and the cost of implementation. Encryption and pseudonymisation are named in the article itself.

• Personal data encrypted at rest and in transit (Art. 32)
• Access controls enforce least-privilege
• MFA enabled for systems processing personal data
• Regular vulnerability assessments and penetration testing
• Security patches applied promptly
• Employee security awareness training covers data protection
• Physical security protects systems storing personal data

Data Breach Response (6 items)

Notify the supervisory authority within 72 hours of becoming aware of a breach unless it is unlikely to result in a risk, and tell the people affected without undue delay if the risk is high. Guide: the 72-hour rule step by step.

• Incident response plan documented and tested (Art. 33-34)
• Supervisory authority notified within 72 hours of becoming aware, unless the breach is unlikely to result in a risk (Art. 33(1))
• Data subject notification process for high-risk breaches (Art. 34)
• Breach register maintained (Art. 33(5))
• Supervisory authority notification template pre-drafted (Art. 33(3))
• Post-breach lessons learned process in place

Processors & Third Parties (5 items)

Every processor needs a contract with the Article 28(3) terms, and you remain responsible for choosing processors with sufficient guarantees. Guide: DPA clause-by-clause checklist.

• Data Processing Agreements with all processors (Art. 28)
• Processors provide sufficient security guarantees
• Sub-processor usage disclosed and controlled
• Joint controller arrangements in place where you decide purposes and means with another organization (Art. 26) (optional)
• Vendor security assessed before onboarding and reviewed periodically

Accountability & Governance (7 items)

Under the accountability principle (Article 5(2)) you must be able to show compliance, not only claim it. Guides: records of processing (Article 30) and DPIA step by step.

• Record of Processing Activities maintained (Art. 30)
• DPO appointed where required (Art. 37) (optional)
• DPIA conducted for high-risk processing (Art. 35) (optional)
• Privacy by design and by default in new projects (Art. 25)
• Staff data protection roles and responsibilities defined
• Regular compliance audits or reviews conducted
• Data protection policies documented, approved, communicated

International Transfers (4 items)

Transfers outside the EEA need an adequacy decision, appropriate safeguards such as SCCs, or an Article 49 derogation (Chapter V). Guide: the EU-US Data Privacy Framework.

• All international data transfers identified and documented (optional)
• Transfer mechanism in place for each transfer: adequacy, SCCs, BCRs or an Art. 49 derogation (Ch. V) (optional)
• Transfer impact assessments for transfers under SCCs or BCRs (optional)
• Supplementary measures implemented where required (optional)

1. List what you process first. Every other item depends on knowing which personal data you hold, why, where it goes and for how long. That list is your record of processing activities (Article 30). Our RoPA guide and the free data mapping tool help you build it.
2. Go through the 48 items with evidence. Tick an item only if you can point to the document, setting or record that proves it: a signed processor agreement, a privacy notice, a breach log. "We do that" without evidence is not done; under Article 5(2) you must be able to demonstrate compliance.
3. Mark "not applicable" with a reason. Thirteen items can be marked not applicable, for example the consent items if you never rely on consent, or the transfer items if no personal data leaves the EEA. Write down why, because a supervisor may ask.
4. Fix the high-risk gaps first. Legal bases, privacy notices, security measures, breach response and processor agreements are where most enforcement starts. The Pro report gives each open item a priority, a recommended action and the article, ordered into a 30/60/90-day plan.
5. Repeat. Run the checklist again at least once a year and whenever you add a new product, supplier or kind of data.

If a customer has sent you a GDPR or security questionnaire to answer, the same evidence will answer most of it. See how to answer a security questionnaire.

Your score is the share of applicable items you have ticked: items done, divided by 48 minus the items you marked not applicable. Every item counts the same, because GDPR does not rank its obligations; use the priorities in the Pro report to decide what to do first.

A high score is not a certificate. GDPR has no official compliance score, and Article 42 certification schemes are voluntary and still rare. The checklist shows where you stand, so you can decide what to fix and show your work.