GDPR Compliance Checklist

Lawful Basis for Processing

You have identified and documented a lawful basis (consent, contract, legitimate interest, etc.) for each data processing activity.

Privacy Policy Published

A clear, comprehensive privacy policy is published and accessible on your website, covering all GDPR-required disclosures.

Consent Mechanism

Where consent is the lawful basis, you collect explicit, informed, and freely given consent with clear opt-in mechanisms.

Data Minimization

You only collect personal data that is necessary for the stated purpose. No excessive data collection.

Right to Access (SAR)

You have a process to respond to Subject Access Requests within 30 days, providing individuals with their personal data.

Right to Erasure

You can delete an individual's personal data upon request ('right to be forgotten') and have documented procedures for this.

Data Breach Response Plan

You have a documented plan to detect, report, and investigate personal data breaches within 72 hours to the supervisory authority.

Data Protection Officer

If required, you have appointed a Data Protection Officer (DPO) or have a designated person responsible for data protection compliance.

Vendor Data Processing Agreements

You have Data Processing Agreements (DPAs) with all third-party vendors who process personal data on your behalf.

Cookie Consent Management

You implement a cookie consent banner that blocks non-essential cookies until the user provides explicit consent.

Data Retention Policy

You have documented retention periods for each category of personal data and automatically delete data when retention periods expire.

Privacy by Design

Data protection is considered from the outset of new projects, systems, and processes - not as an afterthought.