The General Data Protection Regulation applies to any organization that processes personal data of individuals in the European Economic Area, regardless of where the organization is based. This checklist guides you through achieving and maintaining GDPR compliance, from conducting your initial data audit through ongoing privacy program management. Use it whether you are a data controller, processor, or both.
Work through each phase in order. Most organizations complete this checklist in 3-9 months for initial compliance program implementation.
7 items in this phase
Clarify whether your organization acts as a data controller (determines purposes and means of processing), data processor (processes on behalf of a controller), or both. This distinction drives your specific obligations under GDPR.
Determine whether your organization is required to appoint a DPO based on your core activities, data volumes, or processing of special category data. If required, appoint a qualified individual and register them with the supervisory authority.
Identify all personal data your organization collects, processes, stores, and shares. Document data categories, sources, purposes, legal bases, retention periods, and international transfers for each processing activity.
For each processing activity, determine and document the appropriate lawful basis (consent, contract, legal obligation, vital interests, public task, or legitimate interests). Conduct and document Legitimate Interest Assessments where applicable.
Perform a gap analysis comparing your existing privacy program to GDPR requirements. Identify deficiencies in policies, technical controls, consent mechanisms, and data subject rights processes.
Develop a prioritized remediation roadmap with clear milestones, resource assignments, and timelines. Obtain executive sponsorship and budget approval for the compliance program.
Map all transfers of personal data outside the EEA. Determine which transfer mechanisms are needed, such as Standard Contractual Clauses, adequacy decisions, or Binding Corporate Rules.
11 items in this phase
Create transparent privacy notices that clearly communicate what data you collect, why you process it, who you share it with, retention periods, and how individuals can exercise their rights.
Deploy consent collection, storage, and withdrawal mechanisms for processing activities that rely on consent. Ensure consent is freely given, specific, informed, and unambiguous with clear affirmative action.
Implement processes and systems to handle access, rectification, erasure, portability, restriction, and objection requests within the 30-day response deadline. Document each request and response.
Create and maintain Article 30 Records of Processing Activities (ROPA) documenting all processing operations, including purposes, data categories, recipients, transfers, and retention schedules.
Develop a DPIA framework for assessing high-risk processing activities before they begin. Include risk identification, mitigation measures, and supervisory authority consultation procedures when residual risk remains high.
Establish a breach detection, assessment, and notification process that meets the 72-hour supervisory authority notification deadline. Include criteria for when individual notification is required.
Review all processing activities to ensure only necessary data is collected. Implement automated retention policies that delete or anonymize personal data when the processing purpose expires.
Enter into GDPR-compliant DPAs with every third party that processes personal data on your behalf. Ensure agreements cover Article 28 requirements including security measures, sub-processing, and audit rights.
Implement encryption, pseudonymization, access controls, and other technical measures appropriate to the risk level of your processing activities as required by Article 32.
Put appropriate transfer mechanisms in place for all identified cross-border data flows. Execute Standard Contractual Clauses, conduct Transfer Impact Assessments, and implement supplementary measures where required.
Train all employees who handle personal data on GDPR principles, data subject rights, breach reporting procedures, and their individual responsibilities. Maintain training records and refresh annually.
6 items in this phase
Perform a comprehensive review of all privacy controls, policies, and procedures against GDPR requirements. Test that data subject rights workflows, breach notification procedures, and consent mechanisms function correctly.
Exercise your Article 28 audit rights to verify that data processors are meeting their contractual obligations. Review their security measures, sub-processing arrangements, and breach notification capabilities.
Submit test requests through each rights channel to verify that workflows are functioning, responses are timely and complete, and identity verification procedures are adequate.
Verify that valid consent records exist for all consent-based processing. Confirm that other lawful bases are properly documented and that Legitimate Interest Assessments are current.
Verify that personal data is being deleted or anonymized in accordance with documented retention schedules. Test deletion mechanisms across all systems, including backups and archives.
Conduct a tabletop exercise simulating a personal data breach. Test the 72-hour notification timeline, document escalation paths, and verify that communication templates are ready for both supervisory authorities and affected individuals.
5 items in this phase
Update your ROPA whenever new processing activities are introduced, existing ones change, or data flows are modified. Conduct quarterly reviews to ensure accuracy.
Stay current with supervisory authority guidance, European Data Protection Board opinions, and enforcement decisions that may affect your compliance program or require policy updates.
Periodically review DPAs with processors to ensure they reflect current processing activities, incorporate updated Standard Contractual Clauses, and address any changes in sub-processing arrangements.
Re-evaluate Data Protection Impact Assessments annually or when processing activities change materially. Document any new risks identified and the measures taken to mitigate them.
Review and update privacy notices when processing activities, third-party relationships, or legal requirements change. Ensure consent collection mechanisms remain compliant with evolving guidance.
3-9 months for initial compliance program implementation
$15,000-$200,000 depending on data volumes, complexity, and whether a DPO is required
Any organization that processes personal data of individuals in the European Economic Area must comply with GDPR, regardless of where the organization is based. This includes companies offering goods or services to EU residents and those monitoring the behavior of EU individuals. Even a US-based SaaS company with European customers must comply.
GDPR fines can reach up to 4% of annual global turnover or EUR 20 million, whichever is higher, for the most serious violations (such as insufficient legal basis for processing or violating data subject rights). Less severe violations can result in fines up to 2% of turnover or EUR 10 million. Supervisory authorities also consider the organization's cooperation and remediation efforts.
A DPO is required if you are a public authority, if your core activities involve regular and systematic monitoring of individuals on a large scale, or if you process special categories of data (health, biometric, genetic) on a large scale. Even when not mandatory, appointing a DPO is recommended as a best practice for organizations with significant data processing operations.
A DPIA is a risk assessment required before processing that is likely to result in a high risk to individuals' rights and freedoms. This includes systematic profiling, large-scale processing of special category data, and public monitoring. The DPIA must describe the processing, assess necessity and proportionality, evaluate risks, and identify mitigation measures.
You must respond to data subject access requests within 30 days (extendable by two months for complex requests). Verify the requester's identity, search all systems for their data, and provide a copy in a commonly used electronic format. You cannot charge a fee unless the request is manifestly unfounded or excessive.
Yes, but you need a valid transfer mechanism. Options include transferring to countries with an adequacy decision (such as the EU-US Data Privacy Framework), using Standard Contractual Clauses with a Transfer Impact Assessment, or relying on Binding Corporate Rules for intra-group transfers. Each mechanism has specific requirements that must be met.
You must notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals' rights and freedoms. If the breach poses a high risk to affected individuals, you must also notify them without undue delay. Document all breaches in an internal breach register regardless of whether notification is required.
PoliWriter creates all the policies referenced in this checklist, customized to your organization. AI-powered, audit-ready, hours not months.
Get Started Free