GDPR Compliance Checklist

1. A map of the personal data you hold art. 5(2), 24

   List what personal data you hold about customers, staff, suppliers and visitors, where it comes from, why you use it, where it is stored, who receives it and how long you keep it.

   Why it matters: You must be able to show that you comply (accountability); every other item builds on this map.

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional
2. Records of processing activities art. 30

   Keep a written record with your name and contacts, purposes, categories of people and data, recipients, transfers, retention periods and a description of security measures. Organisations with fewer than 250 staff are exempt only if the processing is occasional, unlikely to risk people’s rights and includes no special category or criminal offence data — regular processing such as payroll or a customer list is not occasional.

   Done Partly Not yet N/A

   Standard fine tier — art. 83(4)
   Owner

   Target date

   What is left to do Why it does not apply optional
3. Your role for each processing: controller, joint controller or processor art. 4(7)–(8), 26

   Decide for each activity whether you decide why and how the data is used (controller), share that decision with another (joint controllers, who need an arrangement setting out who does what), or act only on someone else’s instructions (processor).

   Done Partly Not yet N/A

   Standard fine tier — art. 83(4)
   Owner

   Target date

   What is left to do Why it does not apply optional
4. UK: the data protection fee paid (unless exempt) Data Protection (Charges and Information) Regulations 2018

   Organisations, including sole traders, that process personal information must pay the ICO a data protection fee each year unless an exemption applies. Use the ICO’s fee self-assessment to check your tier or exemption.

   ICO: data protection fee

   Done Partly Not yet N/A

   UK fee rules
   Owner

   Target date

   What is left to do Why it does not apply optional

Nothing to show here with this filter.

Article 5 principles and the Article 6 lawful bases carry the higher fine tier.

1. A lawful basis chosen and recorded for each purpose art. 6(1); UK: art. 6(1)(ea), Annex 1

   Consent, contract, legal obligation, vital interests, public task or legitimate interests — chosen before you start and recorded in your records and your privacy notice. In the UK there is also a list of “recognised legitimate interests” (for example crime prevention and safeguarding) that needs no balancing test.

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional
2. A legitimate interests assessment where you rely on it art. 6(1)(f)

   Write down the interest, why the processing is necessary for it and why it is not overridden by the person’s interests and rights (purpose, necessity and balancing tests).

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional
3. Consent that meets the GDPR standard, with records art. 4(11), 7

   Freely given, specific, informed and unambiguous, by a clear affirmative act (no pre-ticked boxes), separate from other terms, as easy to withdraw as to give — and records of who consented, when and to what.

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional
4. A condition for special category and criminal offence data art. 9, 10

   For health, biometric, genetic, racial or ethnic, political, religious, trade union, sex life or sexual orientation data you need an Article 9 condition as well as a lawful basis; for criminal offence data, Article 10. In the UK many conditions also need an appropriate policy document (DPA 2018 Schedule 1).

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional
5. Only the data you need, kept accurate art. 5(1)(c), (d)

   Collect only what each purpose needs, keep it accurate and up to date, and correct or delete what is wrong.

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional
6. A retention schedule that is followed art. 5(1)(e)

   Decide how long each kind of data is kept and why (legal retention periods, limitation periods, the purpose), and delete or anonymise it on time.

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional
7. Parental consent for children’s online services art. 8

   Where you rely on consent for an online service offered directly to a child, get the consent of the holder of parental responsibility below the age of digital consent — 16 unless the Member State set a lower age (not below 13); 13 in the UK — and make reasonable efforts to verify it.

   Done Partly Not yet N/A

   Standard fine tier — art. 83(4)
   Owner

   Target date

   What is left to do Why it does not apply optional

Nothing to show here with this filter.

1. A complete privacy notice, given when you collect the data art. 12, 13

   Who you are and how to contact you (and your DPO), each purpose with its lawful basis, legitimate interests relied on, recipients, transfers and their safeguards, retention periods, the rights to access, rectify, erase, restrict, object and port, to withdraw consent and to complain to a supervisory authority, whether providing the data is required, and any automated decisions — in concise, plain language.

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional
2. People told when you get their data from someone else art. 14

   When you obtain personal data from another source, give the Article 14 information (including the source) within a reasonable period and at the latest within one month, or when you first contact the person.

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional
3. Consent before non-essential cookies and trackers ePrivacy Directive art. 5(3); UK: PECR reg. 6

   Ask before setting analytics, advertising or social media cookies and similar technologies, with a real choice to refuse. Strictly necessary cookies need no consent; in the UK the Data (Use and Access) Act 2025 added exceptions such as some statistics and website-functionality cookies, with conditions.

   Done Partly Not yet N/A

   ePrivacy / PECR
   Owner

   Target date

   What is left to do Why it does not apply optional
4. Marketing e-mails and texts: consent or soft opt-in, and an opt-out every time ePrivacy Directive art. 13; UK: PECR regs. 22, 23; GDPR art. 21(2)–(3)

   Send electronic marketing to individuals only with their consent, or to existing customers about similar products (the “soft opt-in”) if they could opt out when you collected the details; give an easy opt-out in every message and honour it.

   Done Partly Not yet N/A

   ePrivacy / PECR
   Owner

   Target date

   What is left to do Why it does not apply optional

Nothing to show here with this filter.

Answer without undue delay and within one month (art. 12(3)).

1. A process for rights requests: one month, free of charge art. 12(2)–(6)

   Train staff to recognise requests made in any form, verify identity proportionately, answer without undue delay and within one month (extendable by two months for complex or many requests, telling the person within the first month), and charge nothing unless a request is manifestly unfounded or excessive. In the UK the time starts once you have what you need to confirm identity (or a fee you may charge), and may pause while you ask for clarification you reasonably need.

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional
2. Right of access: a copy of the data and the supplementary information art. 15

   Confirm whether you process the person’s data and give a copy with the purposes, recipients, retention, source and rights. In the UK you need make only reasonable and proportionate searches.

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional
3. Rectification, erasure and restriction — and recipients told art. 16–19

   Correct inaccurate data, erase data when a ground in Article 17 applies (for example consent withdrawn or no longer needed), restrict processing while a dispute is checked, and tell the recipients you shared it with.

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional
4. Data portability art. 20

   Where processing is based on consent or a contract and is automated, give people the data they provided in a structured, commonly used, machine-readable format, or send it to another controller.

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional
5. Right to object — always for direct marketing art. 21

   Stop processing based on legitimate interests or public task when someone objects, unless you have compelling legitimate grounds; stop direct marketing whenever asked, and tell people about this right at the latest in your first communication.

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional
6. Safeguards for solely automated decisions with significant effects art. 22; UK: arts. 22A–22D

   For decisions with legal or similarly significant effects made without meaningful human involvement: in the EU use them only under an Article 22(2) exception; in the UK they are allowed more widely but special category data stays restricted. In both, tell people, let them get human intervention, express their view and contest the decision.

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional
7. UK: a way to complain to you, acknowledged within 30 days DPA 2018 as amended by the Data (Use and Access) Act 2025

   Help people complain about how you use their data — for example with an electronic complaints form — acknowledge each complaint within 30 days, make enquiries, keep the person informed and tell them the outcome without undue delay.

   Done Partly Not yet N/A

   UK only
   Owner

   Target date

   What is left to do Why it does not apply optional

Nothing to show here with this filter.

1. An Article 28 contract with every processor art. 28(3)

   The contract sets the subject matter, duration, nature and purpose, types of data and categories of people, and requires the processor to act only on your documented instructions, keep staff confidential, secure the data, use sub-processors only with your authorisation, help with rights requests and breaches, delete or return the data at the end, and allow audits.

   Done Partly Not yet N/A

   Standard fine tier — art. 83(4)
   Owner

   Target date

   What is left to do Why it does not apply optional
2. Processors checked before you use them art. 28(1)

   Use only processors that give sufficient guarantees of appropriate security and compliance — check their security documentation, certifications and where they store data.

   Done Partly Not yet N/A

   Standard fine tier — art. 83(4)
   Owner

   Target date

   What is left to do Why it does not apply optional
3. If you are a processor: instructions, records and sub-processors art. 28(2)–(4), 29, 30(2)

   Process clients’ data only on their documented instructions, tell them if an instruction breaks the law, keep a record of the processing you do for each client, and use sub-processors only with their authorisation and the same contract terms.

   Done Partly Not yet N/A

   Standard fine tier — art. 83(4)
   Owner

   Target date

   What is left to do Why it does not apply optional

Nothing to show here with this filter.

1. Security appropriate to the risk art. 32

   Measures matched to the risk: access control, encryption or pseudonymisation where suitable, the ability to keep systems running and restore data after an incident, and regular testing of the measures.

   Done Partly Not yet N/A

   Standard fine tier — art. 83(4)
   Owner

   Target date

   What is left to do Why it does not apply optional
2. Breaches reported to the supervisory authority within 72 hours art. 33(1), (3), (4)

   Notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to people — with the reasons if later. Information may be given in phases.

   ICO: report a breach

   Done Partly Not yet N/A

   Standard fine tier — art. 83(4)
   Owner

   Target date

   What is left to do Why it does not apply optional
3. Processors tell you about breaches without undue delay art. 33(2)

   Make it a contract duty, with the details you need for your own notification.

   Done Partly Not yet N/A

   Standard fine tier — art. 83(4)
   Owner

   Target date

   What is left to do Why it does not apply optional
4. People told when a breach is likely to put them at high risk art. 34

   Tell the affected people without undue delay, in clear language, what happened, the likely consequences, what you are doing and whom to contact — unless the data was unintelligible to others (for example encrypted), the risk no longer exists, or it would take disproportionate effort (then a public notice).

   Done Partly Not yet N/A

   Standard fine tier — art. 83(4)
   Owner

   Target date

   What is left to do Why it does not apply optional
5. Every breach logged, even if not reported art. 33(5)

   Record the facts, effects and remedial action of every personal data breach, so the supervisory authority can check your decisions.

   Done Partly Not yet N/A

   Standard fine tier — art. 83(4)
   Owner

   Target date

   What is left to do Why it does not apply optional

Nothing to show here with this filter.

1. A DPIA before high-risk processing art. 35, 36

   Screen new projects; carry out a data protection impact assessment before processing likely to be high risk — always for systematic and extensive profiling with significant effects, large-scale special category or criminal data, or large-scale monitoring of public areas, and for the types on your supervisory authority’s list. Consult the authority first if a high risk remains.

   Done Partly Not yet N/A

   Standard fine tier — art. 83(4)
   Owner

   Target date

   What is left to do Why it does not apply optional
2. Data protection by design and by default art. 25

   Build data protection into new systems and processes, and set defaults so that only the data needed for each purpose is processed and not made public without the person’s action.

   Done Partly Not yet N/A

   Standard fine tier — art. 83(4)
   Owner

   Target date

   What is left to do Why it does not apply optional
3. A decision on whether you need a DPO — and one appointed if so art. 37–39

   A Data Protection Officer is required for public authorities and where your core activities involve regular and systematic monitoring of people on a large scale, or large-scale special category or criminal offence data. Record the decision; if you appoint one, publish the contact details and tell the supervisory authority.

   Done Partly Not yet N/A

   Standard fine tier — art. 83(4)
   Owner

   Target date

   What is left to do Why it does not apply optional
4. A representative in the EU (or the UK) art. 3(2), 27

   If you are not established in the EU (or the UK) but offer goods or services to people there or monitor their behaviour, appoint a representative in writing — unless the processing is occasional, not large-scale special category or criminal data, and unlikely to be risky.

   Done Partly Not yet N/A

   Standard fine tier — art. 83(4)
   Owner

   Target date

   What is left to do Why it does not apply optional
5. Staff trained and bound to confidentiality art. 29, 32(4), 39(1)(b)

   Train everyone who handles personal data, make confidentiality part of their terms, and repeat the training when rules or systems change.

   Done Partly Not yet N/A

   Standard fine tier — art. 83(4)
   Owner

   Target date

   What is left to do Why it does not apply optional

Nothing to show here with this filter.

Transfers outside the EEA (or the UK) need a transfer tool under Chapter V.

1. Every transfer outside the EEA or the UK identified art. 44

   Include remote access and cloud and support providers abroad, with the destination country and the transfer tool used for each.

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional
2. A transfer tool for each transfer art. 45–47, 49

   An adequacy decision (the European Commission’s list includes the UK and, for certified US companies, the EU-US Data Privacy Framework; the UK has its own list), standard contractual clauses (the EU SCCs, or in the UK the IDTA or the UK Addendum), binding corporate rules, or — in limited cases such as occasional transfers — an Article 49 derogation.

   European Commission: adequacy decisions

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional
3. A transfer risk assessment where you use contract clauses art. 46

   Before relying on SCCs, the IDTA or the Addendum, assess whether the destination’s laws and practices let the safeguards work, and add measures (for example encryption) where they do not.

   Done Partly Not yet N/A

   Higher fine tier — art. 83(5)
   Owner

   Target date

   What is left to do Why it does not apply optional

Nothing to show here with this filter.