← All checklists
GDPR readiness checklist
Every GDPR obligation a controller or processor has to act on, mapped to its article, with the evidence a supervisory authority or auditor will ask for. Preview 14 of the 90 items below; the full checklist comes as a branded, fillable PDF.
Checklist v1.0Covers GDPR Regulation (EU) 2016/679Reviewed 30 Oct 202690 items · 12 sections
Scope and accountability
6 items
- Art. 3
(2) Confirm whether GDPR applies to you, including when you have no EU establishment but offer goods or services to people in the EU or monitor their behaviour there.Evidence: Written applicability assessment covering establishments, markets and monitoring.
DPO, records and privacy by design
8 items
- Art. 37
(1) Decide whether you must appoint a Data Protection Officer: public bodies, large scale systematic monitoring, or large scale special category or criminal data as a core activity. Record the decision either way.Evidence: DPO assessment memo and, where required, appointment letter.
Principles and lawful basis
10 items
- Art. 5
(1) Process personal data lawfully, fairly and in a way that is transparent to the people it is about.Evidence: Processing records linked to lawful basis and notices.(a) - Art. 5
(1) Collect data for specified, explicit and legitimate purposes and do not reuse it for something incompatible.Evidence: Purpose statements per processing activity.(b)
Consent and children
7 items
- Art. 4
(11) Make sure any consent you rely on is freely given, specific, informed and an unambiguous clear affirmative action. Pre-ticked boxes and silence do not count.Evidence: Screenshots of consent flows showing opt-in controls.
Transparency and notices
8 items
- Art. 12
(1) Write privacy information in concise, clear and plain language that is easy to find, especially anything aimed at children.Evidence: Published privacy notice and readability review.
Handling rights requests
6 items
- Art. 12
(2) Make it easy to exercise rights, with a clear intake channel that staff know how to route.Evidence: Request intake form or address and internal routing procedure.
Individual rights
11 items
- Art. 15
(1) On an access request, confirm whether you process the person's data and give them the purposes, categories, recipients, retention, source and their rights.Evidence: Access request response template and completed samples. - Art. 15
(3) Provide a copy of the personal data, in a common electronic format if the request came electronically, without exposing other people's data.Evidence: Data export process covering all systems in the record of processing.
Processors and joint controllers
8 items
- Art. 28
(1) Use only processors that give sufficient guarantees of appropriate security and data protection, and check this before signing.Evidence: Vendor due diligence records and security reviews.
International transfers
6 items
- Art. 44Map every transfer of personal data outside the EEA, including remote access and onward transfers by vendors.Evidence: Transfer map listing destination countries, recipients and mechanism.
Security of processing
7 items
- Art. 5
(1) Protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage.Evidence: Information security policy covering personal data.(f)
Data protection impact assessments
6 items
- Art. 35
(1) Run a DPIA before starting processing that is likely to result in high risk to people, especially with new technologies.Evidence: DPIA screening procedure and completed screenings.
Personal data breaches
7 items
- Art. 33
(1) Notify the supervisory authority without undue delay and within 72 hours of becoming aware of a breach, unless it is unlikely to result in risk to people. Explain any delay past 72 hours.Evidence: Breach response plan with the 72 hour clock and notification records.
Changelog
- v1.030 Oct 2026First release. Covers GDPR controller and processor obligations, including rights deadlines, transfers, DPIAs and 72 hour breach notification.
Take it to your team
Fillable PDF with owner and target date fields, your name on every page.