Gdpr checklist

GDPR Compliance Checklist

Disclaimer: This is informational only and does not constitute legal advice. Consult qualified legal counsel for your specific situation.

Applicability

GDPR applies if you:

• Are established in the EU/EEA
• Offer goods/services to EU residents (regardless of payment)
• Monitor behavior of EU residents

1. Lawful Basis for Processing

You must identify and document a lawful basis before processing begins.

Basis	When to Use
Consent	Marketing, non-essential cookies, optional features
Contract	Fulfilling a contract the data subject is party to
Legal obligation	Compliance with law (tax, employment)
Vital interests	Life-or-death emergencies only
Public task	Government/public authority functions
Legitimate interests	Business need that doesn't override individual rights — requires LIA

Legitimate Interests Assessment (LIA)

1. Purpose test: Is the purpose legitimate?
2. Necessity test: Is processing necessary for that purpose?
3. Balancing test: Do individual interests override yours?

Consent Requirements

• Freely given (no bundling with service terms)
• Specific (separate consent per purpose)
• Informed (plain language, named third parties)
• Unambiguous (affirmative action, no pre-ticked boxes)
• Withdrawable at any time as easily as given
• Documented with timestamp, method, and version

2. Data Subject Rights (8 Rights)

Right to Be Informed (Articles 13–14)

• Privacy notice at point of collection
• 13 mandatory elements in notice
• Update notice within 1 month of changes

Right of Access (Article 15)

• Respond within 1 month (extendable to 3 months for complex requests)
• Provide copy of data in machine-readable format
• Include: purposes, categories, recipients, retention, source
• Cannot charge fee (unless manifestly unfounded/excessive)

Right to Rectification (Article 16)

• Correct inaccurate data within 1 month
• Complete incomplete data
• Notify third parties you've shared data with

Right to Erasure / "Right to be Forgotten" (Article 17)

Applies when:

• Data no longer necessary for original purpose
• Consent withdrawn and no other basis
• Objection upheld
• Unlawfully processed
• Legal obligation requires deletion

Exceptions: freedom of expression, legal obligation, public health, scientific/historical research, legal claims.

Right to Restrict Processing (Article 18)

• Mark data as restricted (do not process, only store)
• Notify before lifting restriction
• Triggers: accuracy contested, unlawful processing, controller no longer needs data, objection pending

Right to Data Portability (Article 20)

• Provide data in structured, commonly used, machine-readable format (JSON, CSV)
• Transfer directly to another controller where technically feasible
• Applies only to data provided by the subject, processed by consent or contract

Right to Object (Article 21)

• Immediately stop processing when objection received
• Burden on you to demonstrate compelling legitimate grounds
• Absolute right to object to direct marketing processing

Rights Related to Automated Decision-Making (Article 22)

• Do not make solely automated decisions with legal/significant effect without human review option
• Provide meaningful information about the logic
• Allow right to contest the decision

3. Data Protection by Design and Default

By Design

• Consider data protection at system design stage
• Data minimization: collect only what is necessary
• Pseudonymization by default where possible
• End-to-end encryption for sensitive data in transit and at rest

By Default

• Default settings should be most privacy-protective
• Opt-in (not opt-out) for non-essential processing
• Minimum retention periods enforced automatically

4. Data Protection Impact Assessment (DPIA)

Mandatory when processing is "likely to result in high risk":

• Systematic profiling with legal/significant effects
• Large-scale processing of special category data
• Systematic monitoring of publicly accessible areas
• New technologies with unknown risks

DPIA Process

1. Describe the processing (purpose, nature, scope, context)
2. Assess necessity and proportionality
3. Identify and assess risks to data subjects
4. Identify measures to mitigate risks
5. Consult DPA if residual risk remains high
6. Document and review annually or on change

5. Data Breach Notification

Timeline

• 72 hours: Notify supervisory authority (DPA) from becoming aware
• Without undue delay: Notify affected data subjects if high risk

Notification to DPA Must Include

• Nature of the breach (categories and approximate number of records)
• Name and contact details of DPO
• Likely consequences
• Measures taken/proposed to address the breach

Notification to Data Subjects (High-Risk Breaches)

• Plain language description of the breach
• DPO contact details
• Likely consequences
• Measures taken to mitigate harm

Breach Log (Even if No Notification Required)

Maintain internal record of all breaches including: description, effects, remediation, decision rationale.

6. International Data Transfers

Transfer outside EEA only when:

Mechanism	Notes
Adequacy decision	UK, Switzerland, Japan, Canada (commercial), Israel, South Korea, New Zealand
Standard Contractual Clauses (SCCs)	2021 SCCs — 4 modules available
Binding Corporate Rules (BCRs)	For intra-group transfers, requires DPA approval
Approved certification	APEC CBPR, EU-US Data Privacy Framework
Derogations	Explicit consent, contract performance, public interest, legal claims, vital interests

Transfer Impact Assessment (TIA)

Required for SCCs: assess destination country's law and practice against EU standards.

7. Data Protection Officer (DPO)

Mandatory when:

• Public authority or body
• Core activities require large-scale systematic monitoring of individuals
• Core activities require large-scale processing of special category data

DPO Requirements

• Expert knowledge of data protection law
• Independent (cannot be dismissed for performing DPO tasks)
• Report to highest management level
• Published contact details (register with DPA)
• Involved in all data protection matters from earliest stage

8. Record of Processing Activities (RoPA)

Required for organizations with 250+ employees OR processing that is not occasional / involves special categories / risks to individuals.

RoPA Must Contain (Article 30)

• Controller name and contact details
• Processing purposes
• Categories of data subjects and personal data
• Categories of recipients (including third countries)
• Retention schedules
• Security measures description
• International transfers and safeguards

9. Data Processing Agreements (DPAs)

Required when engaging processors (vendors who process data on your behalf).

Mandatory Clauses (Article 28)

• Process only on documented instructions
• Confidentiality obligations on personnel
• Appropriate security measures (Article 32)
• Subprocessor approval requirement
• Assist controller with data subject rights
• Delete or return data at end of service
• Provide audit assistance

10. Special Category Data

Extra protection required for:

• Racial/ethnic origin
• Political opinions
• Religious/philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data (for unique identification)
• Health data
• Sex life/sexual orientation

Additional lawful basis required (Article 9): explicit consent, employment law, vital interests, legitimate activities of nonprofit, made public by subject, legal claims, substantial public interest, health/social care, public health, archiving/research.

Quick Compliance Checklist

• Privacy notice published and up to date
• RoPA maintained
• Lawful basis documented for each processing activity
• Consent records with timestamps stored
• DPAs signed with all processors
• Data subject request process documented and tested
• Breach response procedure documented
• DPIA completed for high-risk processing
• International transfer mechanisms in place
• DPO appointed (if required) and registered
• Data retention schedule enforced
• Privacy by design in SDLC process